{"id":831648,"url":"https://alion.io/job/therapynotes-cyber-security-engineer-application-security","title":"Cyber Security Engineer (Application Security)","company":{"id":688861,"name":"TherapyNotes","domain":"therapynotes.com","url":"https://alion.io/company/therapynotes","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Philadelphia, United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":110000,"max":130000,"currency":"USD","period":"year","gross":null,"usd_annual":130000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"DLP","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"HIPAA","optional":false},{"name":"HL7","optional":false},{"name":"SIEM","optional":false},{"name":"Snyk","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-03T20:49:49Z","employer_posted_date":"2026-11-03","last_verified_at":"2026-11-04T06:58:44Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About Us\nTherapyNotes is the go-to superhero for behavioral health Practice Management and EHR software! Our top-notch SaaS solution handles scheduling, billing, documenting, telehealth, and more so clinicians can focus on awesome patient care.\nWe're a dynamic team of pros who love to innovate and push the envelope, keeping our software cutting-edge. Join us, and let's revolutionize behavioral health software together while making a real difference!\nThe Position\nTherapyNotes is seeking an experienced, hands-on Cyber Security Engineer to own application security across our SDLC and CI/CD pipeline. The right candidate brings deep expertise securing CI/CD pipelines, code and dependency scanning workflows, and infrastructure-as-code, and is comfortable working in a healthcare-regulated environment (HIPAA, HITRUST, HITECH). This role also contributes to broader security engineering efforts - vulnerability management, incident response, and identity and access security - as part of a small, collaborative security team.\nRequired Skills and Experience\nBachelor's degree in information security, computer science, or related field preferred; equivalent experience considered.\n5+ years in application security or security engineering.\nDemonstrated experience securing CI/CD pipelines and GitHub Actions - including SAST/DAST, code/secret/dependency-scanning triage (e.g., GitHub Advanced Security, Snyk), runner and workflow-permission security, and third-party action/supply-chain risk.\nExperience reviewing Terraform or other infrastructure-as-code for security misconfigurations.\nWorking knowledge of SIEM, EDR/XDR, and DLP platforms - deployment, tuning, and alert triage.\nUnderstanding of Zero Trust architecture principles and how they apply to application and identity access.\nStrong understanding of healthcare regulations (HIPAA, HITECH, HITRUST) and their impact on application security.\nExperience with API security, particularly integrations with other healthcare systems; familiarity with HL7 or other healthcare data standards preferred.\nPrior experience securing cloud environments (Azure preferred, AWS a plus).\nWillingness to participate in an incident response on-call rotation.\nIndustry certifications such as GWAPT, OSWE, GPEN, or a cloud security certification (Azure/AWS) are ideal; CISSP or HCISPP a plus but not a substitute for hands-on tooling experience.\nApplication Security Responsibilities\nCollaborate with developmental teams to ensure security is continuously integrated into the Software Development Lifecycle (SDLC) and CI/CD pipeline.\nEnforce secure coding standards and best practices to minimize vulnerabilities and to protect the confidentiality, integrity, and availability of our customer's data.\nPerform in-depth security assessments, code reviews, and threat modeling on applications to identify potential vulnerabilities and risks.\nOwn and operate GitHub Advanced Security - triage code, secret, and dependency-scanning findings, identify recurring vulnerability patterns and recommend broader fixes, and continuously improve scanning coverage, configuration, and workflows.\nSecure CI/CD pipelines and GitHub Actions - identities, runners, permissions, and secrets - and reduce software supply chain risk through third-party action review, dependency controls, action pinning, and artifact provenance.\nReview Terraform and other infrastructure-as-code for security issues, partnering with IT platform teams on IaC scanning and secure deployment practices.\nEnsure application security measures align with healthcare regulations and standards (e.g., HIPAA, HITRUST, and HITECH) and support regular audits.\nCollaborate with developers to remediate vulnerabilities, providing actionable guidance and ensuring effective patching or mitigation measures.\nDevelop, deploy, and manage security tools and technologies (e.g., SAST, DAST, vulnerability management systems) to automate security testing and scanning processes.\nSupport application security incident response activities, identifying the root cause of security incidents and contributing to resolution strategies.\nContribute to security awareness programs for the development teams, focusing on secure coding practices and proactive security measures.\nAdditional Skills\nPassion for continuous learning and professional development, with a commitment to staying updated and trained on the latest trends and technologies.\nEagerness to engage in new challenges and adapt quickly.\nStrong work ethic and drive to take ownership of projects and see them through to completion.\nStrong collaboration skills, able to work effectively with cross functional teams.\nBenefits\nCompetitive salary - $110,000-$130,000\nEmployer sponsored health, dental, vision, life, and disability insurance\nRetirement plan with company contribution\nAnnual company profit sharing\nPersonal development/training budget\nOpen, collaborative work environment\nExtensive 2-week onboarding plan\nComprehensive mentorship program\nEqual Opportunity Employer Statement & Applicant Rights\nTherapyNotes LLC is an Equal Opportunity Employer and does not discriminate based on race, color, religion, sex, national origin, age, disability, genetic information, or any other protected status under federal, state, or local law. We are committed to providing a workplace free of discrimination and harassment.For more information about your rights under federal employment laws, please review the following:\nKnow Your Rights: Workplace Discrimination is Illegal\n Family and Medical Leave Act (FMLA): Employee Rights Under FMLA\nIf you require a reasonable accommodation during the application process, please contact .\n10/6/2026","description_format":"text","description_chars":5707,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Professional development","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Application Security","EHR & Clinical Software","Practice Management Software"],"lifecycle":[{"event":"open","at":"2026-09-12T16:56:41Z"},{"event":"close","at":"2026-10-29T18:30:21Z"},{"event":"reopen","at":"2026-10-29T21:10:49Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":0,"expected_fill_days":27,"reasons":["conf:4","velocity","win:early"],"computed_at":"2026-11-04T06:34:25Z"},"pay":{"stated_usd_annual":130000,"is_top_pay":false},"html_url":"https://alion.io/job/therapynotes-cyber-security-engineer-application-security","json_url":"https://alion.io/job/therapynotes-cyber-security-engineer-application-security.json","meta":{"generated_at":"2026-11-04T07:31:21Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11723,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":688861},"rest":"https://alion.io/mcp/rest/get_company?id=688861"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftherapynotes-cyber-security-engineer-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftherapynotes-cyber-security-engineer-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftherapynotes-cyber-security-engineer-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/therapynotes-cyber-security-engineer-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftherapynotes-cyber-security-engineer-application-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":831648}},{"tool":"search_jobs","arguments":{"company":"therapynotes.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":831648},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}