Sr. Application Security Engineer (Remote) - job 1 of 2

As a Sr. Application Security Engineer at Rula, your primary responsibilities include safeguarding patient data by enhancing the security of our code and development practices. You’ll collaborate with engineering and product teams to integrate security into Rula’s culture, manage vulnerability programs, and lead threat modeling exercises. Your technical expertise will be essential in applying OWASP Top 10 recommendations and interfacing with third-party pentesters to validate and remediate security findings.

To qualify for the Sr. Application Security Engineer role at Rula, you should have at least 4 years of experience in application security engineering, with a strong background in JavaScript, TypeScript, Node.js, or Ruby. You'll need to demonstrate knowledge of OWASP recommendations and familiarity with common SAST and DAST tools. Preferred qualifications include experience running a bug bounty program and understanding HIPAA requirements related to application security.

At Rula, we prioritize work-life balance. The Sr. Application Security Engineer role offers a fully remote work environment with flexible hours to support both personal and professional commitments. We also provide generous time-off policies, including two company-wide shutdown weeks each year, and paid parental leave for all parents, ensuring that our employees can recharge and focus on their well-being.

The Sr. Application Security Engineer plays a crucial role in protecting sensitive patient data, which directly impacts the quality of mental healthcare at Rula. By ensuring a secure platform, you contribute to creating a safe environment for both patients and providers. Your work promotes trust in Rula’s technology, allowing us to focus on making mental health care accessible and effective for everyone.

At Rula, we offer numerous career development opportunities for the Sr. Application Security Engineer position, including access to wellness events, lunch and learns, and funding for team-building activities. You’ll also have the chance to engage in cross-department projects that enhance your skills while promoting a culture of inclusion and diversity, allowing for personal and professional growth within the organization.

In previous roles, I have utilized the OWASP Top 10 as a framework to identify and address common vulnerabilities in applications. I regularly conducted security assessments which involved analyzing code and configurations to ensure compliance with OWASP guidelines, and I implemented fixes and preventative measures based on this knowledge.

My approach to threat modeling involves identifying potential threats early in the software development lifecycle. I collaborate with development teams to understand the architecture, then systematically identify possible attack vectors using tools like STRIDE or DREAD, which helps prioritize vulnerabilities based on risk level.

I have extensive experience using both Static Application Security Testing (SAST) tools like Checkmarx and Dynamic Application Security Testing (DAST) tools such as OWASP ZAP. I incorporate these tools into CI/CD pipelines to automate security checks and ensure vulnerabilities are caught before production.

Absolutely! At my previous employer, I led the initiation of a bug bounty program by first establishing clear scope and guidelines. Then, I partnered with a platform to launch it, promoting it within the security community to attract ethical hackers. Regular communication and transparency about findings and fixes were key to the program's success.

Compliance with HIPAA starts with understanding and implementing its regulations in all technical designs. I routinely conduct security audits and training sessions, and I work closely with legal and compliance teams to ensure all aspects of application security meet HIPAA standards.

I actively participate in security forums, attend industry conferences, and subscribe to relevant newsletters. Additionally, I dedicate time to continuous learning through online courses and certifications, which helps me stay informed about emerging threats and best practices.

Upon identifying a security incident, my first step is to contain the threat to prevent further exposure. Then, I analyze the incident to understand its cause and the extent of the damage. After remediation, I collaborate with teams to update protocols and improve security measures to prevent similar incidents in the future.

Programming languages that are essential for application security primarily include JavaScript, TypeScript, Node.js, and Ruby, as these are commonly used in web applications. A solid understanding of these languages allows for better code reviews and vulnerability assessments.

Communicating security issues to non-technical teams involves simplifying complex concepts without diluting the urgency. I use analogies and relatable scenarios to illustrate the risks and then provide clear action items to help teams understand how they can contribute to the solution.

Third-party penetration testers are crucial as they provide objective assessments of my applications’ security posture. I rely on their expertise to validate my findings, uncover new vulnerabilities, and create robust remediation plans to strengthen our defenses.