Hinge Health
Lead Security Engineer
Hinge Health, San Francisco, California, United States, 94199
Hinge Health is moving people beyond pain by transforming the way it is treated and prevented. Connecting people digitally and in-person with expert clinical care, we combine advanced technology, AI and a care team of experts to guide people through personalized care directly from their phone. Our approach is proven to reduce pain by 68%, prevent 42% of new opioid prescriptions, and avoid more than half of joint replacement surgeries. Available to 18M people, Hinge Health is trusted by leading health plans and employers, including Land O’Lakes, L.L. Bean, Salesforce, Self-Insured Schools of California, Southern Company, State of New Jersey, US Foods, and Verizon.
Learn more at http://www.hingehealth.comHere at Hinge Health, we welcome all applicants and know a diverse team makes us better and stronger. We look for individuals who embody our leadership principles and we value varied experiences and skill sets. Beyond specific work experience, we also look for unique capabilities and skill sets that are key indicators an applicant will thrive in our fast-paced, frequently evolving environment. If this sounds like the kind of place you’d like to be part of, please apply - we would love to hear from you!Hinge Health Hybrid Model:
We believe that remote work and in-person work have their own advantages and disadvantages, and we want to be able to leverage the best of both worlds. Employees in hybrid roles are required to be in the office 2 days/week. We will be expanding to 3 days/week in the office beginning April of 2024.About the Role
We’re looking for a detail oriented and technically proficient individual to join us in maturing the Product Security group within the Security team. This function is growing, and you will have an opportunity to help shape the group's direction and grow with it. Security Engineers work directly with our Product and Engineering teams to integrate security into the entire Software Development Life Cycle. This includes, working with Product Managers on the design of new or changing features that affect security controls, working with developers on secure methods to implement those features, and working with the infrastructure team to design and deploy a secure platform to run Hinge Health applications. They are expected to proactively identify, assess, advise and assist in the prioritization and remediation of source code security vulnerabilities. Security Engineers are expected to do so using multiple methods and tools including but not limited to manual penetration testing, outputs from automated security scanning tools including Software Composition Analysis, Static Application Security Testing, Dynamic Application Security Testing, and the findings from third-party application penetration tests. Security Engineers also work with the Security Operations and Infrastructure teams to deploy and maintain security tools within the Hinge Health environment and assist in the tuning of these tools. Security Engineers may also advise or implement the proper security controls on cloud platforms as required to meet security and compliance standards. Security Engineers will be part of the incident response team as subject matter experts as needed. They may also be called upon as subject matter experts to assist other teams with third party security assessment requests.The ideal candidate will have experience securing, hardening, and identifying vulnerabilities in web applications, RESTful APIs, and mobile applications (iOS and Android) in a cloud hosted microservice environment. We are looking for an individual who can take a risk-based approach to prioritizing the various aspects of a successful product security program. They should be ready to independently jump in to ask questions and understand the environment and identify potential issues while balancing their findings based on risk and company priorities. The ideal candidate will also have experience implementing and interpreting the results of automated security scans using SCA, SAST and DAST tools and in performing security assessments and penetration tests of web applications and API endpoints and mobile applications They will also have experience assessing the security of
cloud(IaaS) infrastructure, ideally including interpreting automated static scans of Infrastructure as Code source.They should be enthusiastic about working to help improve all aspects of the Software Development Life Cycle and working with product managers to create a secure and delightful experience for Hinge Health customers.
WHAT YOU’LL ACCOMPLISH
Implement automated security scanning tools and perform manual security assessments including source code review to harden Hinge Health web applications and API microservices.Enable the product teams to create secure by design product features and services by working alongside product managers and engineers during the design phase of projects.Assist with third party security assessments and penetration tests of Hinge Health web applications, API endpoints, and mobile applications, including interpretation of results and verification of remediations.Contribute to the improvement of Software Development Life Cycle management policies, procedures, and standards.WHAT WE'RE LOOKING FOR
BS degree in Computer Science, Engineering or relevant fieldAutomated Security Testing: Ability to configure and automate security scans as part of the CI/CD process, interpret the results and work directly with engineers on prioritization and remediation.Secure Coding Practices: Ability to examine source code in multiple languages to evaluate controls. Be able to identify common coding and design vulnerabilities. Deep understanding of OWASP Top 10 and other common security flaws.Communication: Ability to partner with engineers and product managers to implement security by design.Judgment: Ability to assess the risk of vulnerabilities, tradeoffs in designs, etc. to categorize and prioritize remediation work.Incident Handling: Be able to work as a subject matter expert in the security controls, internal communications, and infrastructure of Hinge Health applications during security incidents.Proactive: Enjoys proactively, asking questions and examining systems and processes for possible flaws and reaching out to relevant teams to identify and verify vulnerabilities that may not have been found by automated scanning and schedule manual reviews.BONUS POINTS
Experience securing applications in Health Care, securing ePHI and HIPAA/HITECH regulations.Familiarity with HITRUST CSF and NIST control frameworks.Experience in Threat ModelingExperience performing security assessments and secure design of hardware and firmware of medical devices communicating over BluetoothExperience with any of the following, deploying web based services on AWS infrastructure, Kubernetes, Typescript, ReactNative, Ruby on Rails, GraphQL, IaC using Terraform.WHAT YOU'LL LOVE ABOUT US
Inclusive healthcare and benefits:
On top of comprehensive medical, dental, and vision coverage, we offer employees and their family members help with gender-affirming care, tools for family and fertility planning, and travel reimbursements if healthcare isn’t available where you live.Planning for the future:
Start saving for the future with our traditional or Roth 401k retirement plan options which include a 2% company match.Modern life stipends:
Manage your own learning and development budget, use the mental health to support therapy costs, and lifestyle stipends to cover your favorite wellness services, and work-from-home equipment.Flexible vacation and paid time off:
Employees have flexibility to choose when, how, and why they take time off to rest and recharge. Exempt employees can take advantage of our flexible pto program. Nonexempt employees can utilize up to two weeks of sick time and up to 17 days of vacation per year, including mental health days.In Office Perks : Daily lunch, coffee/tea and office snacks, and weekly social hours.Other compensation : At Hinge Health, we want every employee to be invested and rewarded in the future success of the company. All full-time positions are eligible for equity.About Hinge Health:
LinkedIn recently named Hinge Health one of the Top 50 Startups. Forbes, Fast Company, and Inc. have also recognized our technology, innovation, and culture.Since our founding in 2014, we've raised more than $800 million from leading investors, including Coatue and Tiger Global. We work with 1000 customers across every industry and the public sector — including Salesforce, Verizon, and the State of New Jersey — to give more than 23 million people access to the care they need. We’re positioned to continue leading the market with unmatched investments in clinical research, care innovation, machine learning, AI, and computer vision.Diversity and Inclusion:
We’re committed to building diverse teams that reflect the communities we serve. Visit hingehealth.com/diversity-equity-and-inclusion to learn more about what moves us.Hinge Health is an equal opportunity employer and prohibits discrimination and harassment of any kind. We make employment decisions without regards to race, color, religion, sex, sexual orientation, gender identity, national origin, age, veteran status, disability status, pregnancy, or any other basis protected by federal, state or local law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements.We provide reasonable accommodations for candidates with disabilities. If you feel you need assistance or an accommodation due to a disability, let us know by reaching out to your recruiter.By providing your information through this page or applying for a job at Hinge Health, you acknowledge that Hinge Health will collect, use, and process your information as part of our job application process. For more information on how Hinge Health processes your personal information, click here to view our Applicant and Personnel Privacy Notice.Disclaimer:
There continues to be a significant increase in phishing attempts across all industries where fraudsters are impersonating real employees and sending fictitious job offers to applicants in a scheme to obtain sensitive information. Please note that we will never ask for your financial information at any part of the interview process including the post-offer stage, and will only correspond through @hingehealth.com domain email addresses.If you encounter any suspicious activity, we recommend you cease all communication with the individual and consider reporting them to the U.S. FBI Internet Crime Complaint Center. If you would like to verify the legitimacy of an email you received from our recruiting team, please forward it to security@hingehealth.com*Please do not send resumes via email*
Learn more at http://www.hingehealth.comHere at Hinge Health, we welcome all applicants and know a diverse team makes us better and stronger. We look for individuals who embody our leadership principles and we value varied experiences and skill sets. Beyond specific work experience, we also look for unique capabilities and skill sets that are key indicators an applicant will thrive in our fast-paced, frequently evolving environment. If this sounds like the kind of place you’d like to be part of, please apply - we would love to hear from you!Hinge Health Hybrid Model:
We believe that remote work and in-person work have their own advantages and disadvantages, and we want to be able to leverage the best of both worlds. Employees in hybrid roles are required to be in the office 2 days/week. We will be expanding to 3 days/week in the office beginning April of 2024.About the Role
We’re looking for a detail oriented and technically proficient individual to join us in maturing the Product Security group within the Security team. This function is growing, and you will have an opportunity to help shape the group's direction and grow with it. Security Engineers work directly with our Product and Engineering teams to integrate security into the entire Software Development Life Cycle. This includes, working with Product Managers on the design of new or changing features that affect security controls, working with developers on secure methods to implement those features, and working with the infrastructure team to design and deploy a secure platform to run Hinge Health applications. They are expected to proactively identify, assess, advise and assist in the prioritization and remediation of source code security vulnerabilities. Security Engineers are expected to do so using multiple methods and tools including but not limited to manual penetration testing, outputs from automated security scanning tools including Software Composition Analysis, Static Application Security Testing, Dynamic Application Security Testing, and the findings from third-party application penetration tests. Security Engineers also work with the Security Operations and Infrastructure teams to deploy and maintain security tools within the Hinge Health environment and assist in the tuning of these tools. Security Engineers may also advise or implement the proper security controls on cloud platforms as required to meet security and compliance standards. Security Engineers will be part of the incident response team as subject matter experts as needed. They may also be called upon as subject matter experts to assist other teams with third party security assessment requests.The ideal candidate will have experience securing, hardening, and identifying vulnerabilities in web applications, RESTful APIs, and mobile applications (iOS and Android) in a cloud hosted microservice environment. We are looking for an individual who can take a risk-based approach to prioritizing the various aspects of a successful product security program. They should be ready to independently jump in to ask questions and understand the environment and identify potential issues while balancing their findings based on risk and company priorities. The ideal candidate will also have experience implementing and interpreting the results of automated security scans using SCA, SAST and DAST tools and in performing security assessments and penetration tests of web applications and API endpoints and mobile applications They will also have experience assessing the security of
cloud(IaaS) infrastructure, ideally including interpreting automated static scans of Infrastructure as Code source.They should be enthusiastic about working to help improve all aspects of the Software Development Life Cycle and working with product managers to create a secure and delightful experience for Hinge Health customers.
WHAT YOU’LL ACCOMPLISH
Implement automated security scanning tools and perform manual security assessments including source code review to harden Hinge Health web applications and API microservices.Enable the product teams to create secure by design product features and services by working alongside product managers and engineers during the design phase of projects.Assist with third party security assessments and penetration tests of Hinge Health web applications, API endpoints, and mobile applications, including interpretation of results and verification of remediations.Contribute to the improvement of Software Development Life Cycle management policies, procedures, and standards.WHAT WE'RE LOOKING FOR
BS degree in Computer Science, Engineering or relevant fieldAutomated Security Testing: Ability to configure and automate security scans as part of the CI/CD process, interpret the results and work directly with engineers on prioritization and remediation.Secure Coding Practices: Ability to examine source code in multiple languages to evaluate controls. Be able to identify common coding and design vulnerabilities. Deep understanding of OWASP Top 10 and other common security flaws.Communication: Ability to partner with engineers and product managers to implement security by design.Judgment: Ability to assess the risk of vulnerabilities, tradeoffs in designs, etc. to categorize and prioritize remediation work.Incident Handling: Be able to work as a subject matter expert in the security controls, internal communications, and infrastructure of Hinge Health applications during security incidents.Proactive: Enjoys proactively, asking questions and examining systems and processes for possible flaws and reaching out to relevant teams to identify and verify vulnerabilities that may not have been found by automated scanning and schedule manual reviews.BONUS POINTS
Experience securing applications in Health Care, securing ePHI and HIPAA/HITECH regulations.Familiarity with HITRUST CSF and NIST control frameworks.Experience in Threat ModelingExperience performing security assessments and secure design of hardware and firmware of medical devices communicating over BluetoothExperience with any of the following, deploying web based services on AWS infrastructure, Kubernetes, Typescript, ReactNative, Ruby on Rails, GraphQL, IaC using Terraform.WHAT YOU'LL LOVE ABOUT US
Inclusive healthcare and benefits:
On top of comprehensive medical, dental, and vision coverage, we offer employees and their family members help with gender-affirming care, tools for family and fertility planning, and travel reimbursements if healthcare isn’t available where you live.Planning for the future:
Start saving for the future with our traditional or Roth 401k retirement plan options which include a 2% company match.Modern life stipends:
Manage your own learning and development budget, use the mental health to support therapy costs, and lifestyle stipends to cover your favorite wellness services, and work-from-home equipment.Flexible vacation and paid time off:
Employees have flexibility to choose when, how, and why they take time off to rest and recharge. Exempt employees can take advantage of our flexible pto program. Nonexempt employees can utilize up to two weeks of sick time and up to 17 days of vacation per year, including mental health days.In Office Perks : Daily lunch, coffee/tea and office snacks, and weekly social hours.Other compensation : At Hinge Health, we want every employee to be invested and rewarded in the future success of the company. All full-time positions are eligible for equity.About Hinge Health:
LinkedIn recently named Hinge Health one of the Top 50 Startups. Forbes, Fast Company, and Inc. have also recognized our technology, innovation, and culture.Since our founding in 2014, we've raised more than $800 million from leading investors, including Coatue and Tiger Global. We work with 1000 customers across every industry and the public sector — including Salesforce, Verizon, and the State of New Jersey — to give more than 23 million people access to the care they need. We’re positioned to continue leading the market with unmatched investments in clinical research, care innovation, machine learning, AI, and computer vision.Diversity and Inclusion:
We’re committed to building diverse teams that reflect the communities we serve. Visit hingehealth.com/diversity-equity-and-inclusion to learn more about what moves us.Hinge Health is an equal opportunity employer and prohibits discrimination and harassment of any kind. We make employment decisions without regards to race, color, religion, sex, sexual orientation, gender identity, national origin, age, veteran status, disability status, pregnancy, or any other basis protected by federal, state or local law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements.We provide reasonable accommodations for candidates with disabilities. If you feel you need assistance or an accommodation due to a disability, let us know by reaching out to your recruiter.By providing your information through this page or applying for a job at Hinge Health, you acknowledge that Hinge Health will collect, use, and process your information as part of our job application process. For more information on how Hinge Health processes your personal information, click here to view our Applicant and Personnel Privacy Notice.Disclaimer:
There continues to be a significant increase in phishing attempts across all industries where fraudsters are impersonating real employees and sending fictitious job offers to applicants in a scheme to obtain sensitive information. Please note that we will never ask for your financial information at any part of the interview process including the post-offer stage, and will only correspond through @hingehealth.com domain email addresses.If you encounter any suspicious activity, we recommend you cease all communication with the individual and consider reporting them to the U.S. FBI Internet Crime Complaint Center. If you would like to verify the legitimacy of an email you received from our recruiting team, please forward it to security@hingehealth.com*Please do not send resumes via email*