{"id":3846196,"url":"https://alion.io/job/cala-health-security-engineer","title":"Security Engineer","company":{"id":669478,"name":"Cala Health","domain":"calahealth.com","url":"https://alion.io/company/calahealth","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":155000,"max":190000,"currency":"USD","period":"year","gross":null,"usd_annual":190000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Bash","optional":false},{"name":"CI/CD","optional":false},{"name":"CWE","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitLab CI","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"Jenkins","optional":false},{"name":"Least Privilege","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"JavaScript","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-11-06T00:30:48Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-08T04:25:06Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"About Cala\nAt Cala, we’re working to free people from the burden of chronic disease. We began by creating the first non-invasive prescription therapy for hand tremor. After years of careful fine-tuning and improvements, we recently released kIQ® Plus, our most sophisticated therapy yet. Our products have empowered thousands of people to get back to their lives with confidence and ease.\nBut we won’t stop there. Our pioneering technology can be applied across neurology, cardiology, and beyond. It’s all part of our mission to help people in their struggle with chronic disease. We’re only just getting started\nThe Opportunity\nWe are seeking a hands-on Security Engineer embedded within our engineering organization. In this role, you will be the primary technical authority securing our AWS cloud architecture, modern CI/CD pipelines, and web/connected applications. You will bridge software engineering, DevOps, and security-shifting security left into our build pipelines and ensuring our cloud posture remains audit-ready for SOC 2 and healthcare compliance standards.This is an engineering role, not an IT or corporate security role. The ideal candidate writes code, manages AWS infrastructure controls, integrates automated tooling into Jenkins and GitHub Actions CI/CD workflows, and partners directly with software engineers across the entire Software Development Life Cycle (SDLC).\nTitle: Security Engineer (Cloud & AppSec)\nReports to: Staff DevOps Engineer\nLocation: Remote, but if local to San Mateo, CA - Hybrid\nEmployment type: Full-Time, Exempt\nPay range: $155,000 - $190,000\nFinal compensation is based on experience, skills, market benchmarks, and internal equity, with potential adjustments for candidate location.\nAWS Cloud Security & Infrastructure Hardening\nArchitect, implement, and monitor security controls across our AWS environment using native tooling (AWS GuardDuty, AWS Inspector, Security Hub, IAM Access Analyzer, KMS, and CloudTrail).\nDefine and enforce least-privilege IAM policies, VPC network isolation, and encryption in transit and at rest.\nUse Infrastructure as Code (IaC) security tooling to proactively identify and prevent cloud misconfigurations before deployment.\nDevSecOps & CI/CD Pipeline Security\nEmbed automated security gates into developer workflows and CI/CD pipelines (Jenkins, GitHub Actions, or GitLab CI) using SAST, DAST, and SCA scanning.\nOwn Software Composition Analysis (SCA) to identify vulnerable dependencies, manage container image scanning, and secure build artifacts against software supply chain risks.\nBuild automation scripts (Python, Bash) to automate vulnerability triage, evidence gathering, and security remediation workflows across build environments.\nApplication Security & Vulnerability Remediation\nReview application code, cloud architectures, and pull requests to identify OWASP Top 10 vulnerabilities, auth flaws, and logic bugs early in development.\nScope and manage external penetration tests and bug bounty programs; validate findings and partner directly with engineering squads to write and verify technical remediation fixes.\nSecure APIs and backend endpoints interfacing with connected medical devices and client applications.\nCompliance Automation & Audit Readiness (SOC 2 / HIPAA)\nServe as the primary technical interface for SOC 2 Type II and HIPAA audits, partnering with DevOps to maintain technical security controls and automated evidence collection.\nLeverage continuous compliance and posture management platforms (e.g., Vanta) to ensure production cloud infrastructure continuously meets audit baselines without manual overhead.\nEngineering Incident Response\nInvestigate security alerts generated from AWS GuardDuty, Inspector, and production infrastructure logs.\nLead root-cause analysis (RCA) for application-level and cloud-level security events and build automated prevention mechanisms so the same class of incident cannot recur.\nQualifications & Skills\nRequired Experience\n3+ years of hands-on experience in Cloud Security, Application Security (AppSec), or DevSecOps within a production cloud-native engineering environment.\n Deep AWS Security Expertise: Hands-on experience configuring and operating AWS native security services (GuardDuty, Inspector, Security Hub, AWS Config, IAM policies, and VPC security).\n CI/CD Security Automation: Proven background integrating automated security checks (SAST, SCA, container scanning) into build pipelines using Jenkins and modern CI systems (e.g., GitHub Actions, GitLab CI).\nCompliance in Cloud Environments: Direct experience implementing, maintaining, and gathering automated evidence for technical controls in SOC 2 Type II audits (familiarity with platforms like Vanta is a major plus).\nApplication Security Fundamentals: Strong understanding of OWASP Top 10, CWE, secure authentication/authorization, and modern API security patterns.\nScripting & Automation: Proficiency in Python or Shell scripting (Bash) to automate security tooling, query APIs, and parse logs.\nPreferred Qualifications\nExperience with Infrastructure as Code (IaC) and static analysis tools (e.g., Terraform).\nFamiliarity with additional programming languages used by our engineering team (Python, Javascript).\nExperience with IoT or connected device ecosystems (device provisioning, mutual TLS, secure key rotation, and OTA update pipelines).\nRelevant industry certifications (e.g., AWS Certified Security - Specialty, AWS Solutions Architect, OSCP, or equivalent practical certifications).\n\nApplicants must be authorized to work in the United States on a full-time basis, or eligible for work authorization through a sponsorship path that Cala Health is able to support. Sponsorship decisions are made individually based on role, timeline, and cost considerations, and are not guaranteed.\nCala Health believes our success is based on diversity of people, teams and thinking. We offer all employees the tools, training and mentoring they need to succeed. Our selection process is driven by the key requirements for the role rather than bias or discrimination on the basis of a candidate’s sex, gender identity, age, marital status, veteran status, non-jobrelated disability/handicap or medical condition, family status, sexual orientation, religion, color, ethnicity, race or any other legally protected classification.","description_format":"text","description_chars":6342,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Neurotech & Neuromodulation"],"lifecycle":[{"event":"open","at":"2026-11-06T00:50:45Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 1","filings_12m":1,"filings_prev_12m":3,"green_card_filings_12m":0,"median_offered_wage_usd":152500,"route":null,"cap_exempt":false,"checked_at":"2026-11-07T07:57:00+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":1}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":2,"expected_fill_days":66,"reasons":["conf:1","win:early"],"computed_at":"2026-11-08T05:47:12Z"},"pay":{"stated_usd_annual":190000,"is_top_pay":true},"html_url":"https://alion.io/job/cala-health-security-engineer","json_url":"https://alion.io/job/cala-health-security-engineer.json","meta":{"generated_at":"2026-11-08T07:28:48Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16262,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":669478},"rest":"https://alion.io/mcp/rest/get_company?id=669478"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcala-health-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcala-health-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcala-health-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cala-health-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcala-health-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3846196}},{"tool":"search_jobs","arguments":{"company":"calahealth.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3846196},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}