Senior Security Engineer II

About the role

We are looking for a senior security engineer to lead application security across Blink Health’s web, API, mobile and cloud‑native products. The role will shape security strategy, embed security into the software development lifecycle and drive secure AI‑powered solutions.

Key responsibilities

• Define and drive the application security strategy, including secure architecture reviews for high‑impact products.
• Design and implement scalable security controls that protect web, API, mobile and cloud‑native applications without slowing engineering velocity.
• Mature and automate SAST, DAST, software composition analysis, IaC scanning, secrets detection and container security, integrating them into CI/CD pipelines.
• Lead security reviews and develop secure design patterns for AI‑powered applications, LLM integrations and developer AI tooling.
• Establish organization‑wide API security standards covering authentication, authorization, service identity and runtime protections.
• Conduct threat‑modeling exercises and targeted penetration testing for critical initiatives, and create reusable attack playbooks.
• Act as a trusted advisor to engineering leadership, mentor security engineers and champion security best practices.
• Leverage AI to automate code review, threat modeling, vulnerability triage and security documentation.

Required profile

• Bachelor’s degree in Computer Science, Cybersecurity or a related field.
• 8–12+ years of experience in application security, product security or security engineering.
• Proven experience securing large‑scale cloud‑native applications and deep knowledge of OWASP Top 10, API and mobile security.
• Strong understanding of OAuth2, OIDC, JWT, mTLS and modern authentication mechanisms.
• Hands‑on programming experience in Python, Java, JavaScript, Go or C#.
• Experience building or automating security tooling via scripting or APIs and performing threat modeling.
• Excellent communication skills with the ability to influence senior engineering stakeholders.

Required skills

• SAST, DAST, Software Composition Analysis (SCA)
• Container security and secrets management
• Infrastructure‑as‑Code (IaC) security scanning
• OAuth2, OpenID Connect, JWT, mTLS
• Python, Java, JavaScript, Go, C#
• Scripting or API automation for security tooling
• Threat modeling and security architecture reviews