Application Security Engineer

Strive Health's application security engineer, the main security partner for Product and Engineering as the kidney care company rolls out Canvas Medical, patient-facing portals and future mobile apps. The engineer threat-models those systems and maps where patient health data flows, writes security acceptance criteria into product plans, reviews architecture for tenant isolation, authorisation and IDOR risks, and sets merge request checklists. The role also runs SAST, DAST, SCA and container and IaC scanning, tests APIs and browser flows with Burp Suite, manages the vulnerability pipeline and SLAs, coordinates outside pen tests, and keeps evidence ready for HITRUST and SOC 2.

Strive wants three or more years in security with an AppSec or DevSecOps focus and CI/CD tooling experience. Based in Denver, with some travel.