LandEarly
Get started
Synced from Ashby · Oct 2

Senior Application Security Engineer

turquoise-healthRemotePosted Oct 2, 2026
Application Security EngineerRemoteSenior
Apply nowSave & get alerts

Mirrored from turquoise-health's own Ashby careers system · refreshed hourly

13
Other open turquoise-health roles
Oct 2
Posted
Ashby
Applicant system
Job description

This is a fully remote role in the United States.

Turquoise is hiring a Senior Application Security Engineer to drive security for the applications and data our customers rely on. This role owns application-layer security across Turquoise's platform and is the software counterpart to our infrastructure security. You'll build and tune our code scanning program, driving vulnerabilities from discovery to remediation. Day to day, you'll work closely with engineering teams on the design, architecture, and services our product teams build.

What You'll Do

  • Build and run our application security scanning program (SAST, DAST, dependency/SCA, container and IaC scanning), tuning tools to reduce noise and surface real risk.

  • Triage findings from scans, penetration tests, and bug bounty reports; prioritize by risk and track remediation through to closure.

  • Partner with engineering teams to fix vulnerabilities, including hands-on debugging and code-level guidance when needed.

  • Build trust and cooperation with engineering, product, and design teams so security is considered early in the process, not bolted on at the end (mature SDLC, CI/CD pipelines).

  • Perform threat modeling and maintain secure-coding standards.

  • Support incident response for application-layer security issues.

  • Coordinate and help manage third-party penetration tests.

  • Track and report on security posture metrics (open vulnerabilities, remediation SLAs, scan coverage) to engineering and leadership.

What You'll Bring

  • 5+ years of experience in application security, security engineering, or a related software engineering role with a security focus.

  • Hands-on experience with SAST, DAST, and dependency/SCA scanning tools, and the judgment to distinguish real risk from noise.

  • Deep understanding of common vulnerability classes (OWASP Top 10, authentication/authorization flaws, injection, SSRF, etc.), including the ability to review code and architecture to spot these issues and propose effective fixes.

  • Experience with cloud environments (AWS preferred) and securing modern CI/CD pipelines.

  • Strong communication skills, able to explain risk and remediation steps clearly to engineers and non-security stakeholders alike.

  • A collaborative, pragmatic approach to security that balances risk reduction with shipping velocity.

Nice to Have

  • Experience in healthcare, fintech, or another regulated industry.

  • Experience working within compliance frameworks such as HIPAA, SOC 2, or GDPR.

  • Security certifications such as OSCP, GWAPT, or CSSLP.

  • Experience building or maturing an AppSec program from an early stage.

  • Scripting or automation experience (Python, Go, Terraform, or infrastructure-as-code tool like Terraform.

  • Red team experience performing internal campaigns and providing remediation reports

Benefits

  • Competitive pay with equity options

  • Stellar health care plan options (Medical, Dental & Vision), with FSA, DCFSA, & HSA options

  • Company-sponsored disability & life insurance

  • Unlimited PTO

  • 401(k) + 4% Matching

  • Fully remote work + flexible working hours

  • $750 work-from-home setup budget

  • Paid biannual in-person company summits

  • Quarterly $150 co-hanging stipend to meet up with coworkers

  • Monthly $100 health and wellness benefit

  • Generous paid family leave

  • Annual $1,200 learning & development stipend

About Turquoise Health

Turquoise Health is a Series C price transparency platform for finance leaders across healthcare. Backed by a16z, Oak HC/FT, Adams Street, Yosemite, Bessemer Venture Partners, and others, we power price transparency for 300+ enterprise organizations and are building the infrastructure for a more open, efficient healthcare marketplace. We're a remote-first, US-based team that values transparency, empathy, inclusivity, creativity, and ownership.

We operate on US business hours and work with clients entirely based in the US. For this role, we are seeking US-based candidates.

We strongly encourage BIPOC, people with disabilities, and LGBTQIA+ folks to apply for any open roles of interest. Healthcare affects all people differently, but it significantly affects those in underserved communities. With a robust, diverse team, we are stronger and better equipped to change the future of healthcare for all.

Work Authorization

This role requires current authorization to work in the United States. Turquoise does not sponsor employment visas (H-1B, PERM, etc.) or assume sponsorship of existing visas for this position.

Disability Accommodation Email

Turquoise is committed to providing reasonable accommodations to applicants and employees with disabilities. Please tell us if you require a reasonable accommodation to apply for a job or to perform your job. Examples of reasonable accommodation include making a change to the application process or work procedures, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment. If you require assistance or an accommodation with the hiring process, please contact recruiting@turquoise.health

Note: All official communication from Turquoise will come from a @turquoise.health email address and all open roles are listed at turquoise.health/careers. We never ask candidates for payment or financial information. If you're contacted by anyone using a different domain, please disregard and report it as spam.

View original posting on Ashby

What applying to turquoise-health usually looks like

Based on publicly available information, candidates applying through ashby for roles at Turquoise Health can generally expect a straightforward online application process, typically starting with a form requesting a resume and basic background details. Ashby-based processes commonly include an initial recruiter or hiring manager screen, followed by one or more stages that may involve technical assessments, work samples, or role-specific exercises depending on the position (e.g., engineering, product, or sales roles). Candidates may also encounter take-home tasks or live interviews with team members before a final decision stage. Communication is often handled through automated status updates within the platform, though response times vary by role and team bandwidth. Applicants should be prepared to articulate relevant experience clearly, as ashby's structured format tends to emphasize organized, criteria-based evaluation throughout the hiring process.

Based on publicly available information. LandEarly does not verify interview process details.

Land this one early - before the req fills.

LandEarly tailors your resume and screening answers to each posting, submits while the role is still new, and tracks every application in one place.

Set up in minutes · Cancel anytime · No contract

Get startedSee how it works

Keep exploring

What this role pays, where else it is open, and how to write the application.

Application Security Engineer Jobsturquoise-health JobsCloud Security Engineer JobsApplication Security Engineer salariesRemote application security engineer jobsEngineering hiring reportSoftware Engineer JobsFrontend Engineer JobsBackend Engineer JobsAll companiesState of the job market
Senior Application Security Engineer
turquoise-health · Remote
Apply