Senior Application Security Engineer

Turquoise Health works on healthcare price transparency, the contracted rates and estimates that are supposed to tell an American what a procedure will cost. This role owns security at the application layer across that platform, as the software counterpart to its infrastructure security.

The work is a scanning programme built and then tuned rather than installed: SAST, DAST, dependency and SCA, container and IaC scanning, with the tools adjusted to cut noise and surface real risk. Then the part that decides whether any of it mattered, driving findings from scans, penetration tests and bug bounty reports through to closed, including hands-on debugging and code-level guidance when an engineering team needs it. Threat modeling, secure-coding standards, application-layer incident response and coordinating third-party pen tests are all in scope, as is reporting posture metrics such as open vulnerabilities, remediation SLAs and scan coverage.

The posting asks for the cultural half explicitly, building enough trust with engineering, product and design that security is considered early rather than bolted on. 5+ years of experience. Stated as a fully remote role in the United States. Remote, US.