{"id":1735355,"url":"https://alion.io/job/turquoise-health-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":179689,"name":"Turquoise Health","domain":"turquoise.health","url":"https://alion.io/company/turquoise-health","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":95,"open_postings":3,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":74,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":{"label":"US time zones","utc_offset_min":-8,"utc_offset_max":-5},"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":172000,"max":200000,"currency":"USD","period":"year","gross":null,"usd_annual":200000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":true,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Threat Modeling","optional":false},{"name":"GDPR","optional":true},{"name":"HIPAA","optional":true},{"name":"Python","optional":true},{"name":"Red Teaming","optional":true},{"name":"SOC 2","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-10-02T20:55:22Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-23T20:29:10Z","board_verified":true,"closed_at":null,"days_open":21,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":21},"description":"This is a fully remote role in the United States.\nTurquoise is hiring a Senior Application Security Engineer to drive security for the applications and data our customers rely on. This role owns application-layer security across Turquoise's platform and is the software counterpart to our infrastructure security. You'll build and tune our code scanning program, driving vulnerabilities from discovery to remediation. Day to day, you'll work closely with engineering teams on the design, architecture, and services our product teams build.\nWhat You'll Do\nBuild and run our application security scanning program (SAST, DAST, dependency/SCA, container and IaC scanning), tuning tools to reduce noise and surface real risk.\n\nTriage findings from scans, penetration tests, and bug bounty reports; prioritize by risk and track remediation through to closure.\n\nPartner with engineering teams to fix vulnerabilities, including hands-on debugging and code-level guidance when needed.\n\nBuild trust and cooperation with engineering, product, and design teams so security is considered early in the process, not bolted on at the end (mature SDLC, CI/CD pipelines).\n\nPerform threat modeling and maintain secure-coding standards.\n\nSupport incident response for application-layer security issues.\n\nCoordinate and help manage third-party penetration tests.\n\nTrack and report on security posture metrics (open vulnerabilities, remediation SLAs, scan coverage) to engineering and leadership.\n\nWhat You'll Bring\n5+ years of experience in application security, security engineering, or a related software engineering role with a security focus.\n\nHands-on experience with SAST, DAST, and dependency/SCA scanning tools, and the judgment to distinguish real risk from noise.\n\nDeep understanding of common vulnerability classes (OWASP Top 10, authentication/authorization flaws, injection, SSRF, etc.), including the ability to review code and architecture to spot these issues and propose effective fixes.\n\nExperience with cloud environments (AWS preferred) and securing modern CI/CD pipelines.\n\nStrong communication skills, able to explain risk and remediation steps clearly to engineers and non-security stakeholders alike.\n\nA collaborative, pragmatic approach to security that balances risk reduction with shipping velocity.\n\nNice to Have\nExperience in healthcare, fintech, or another regulated industry.\n\nExperience working within compliance frameworks such as HIPAA, SOC 2, or GDPR.\n\nSecurity certifications such as OSCP, GWAPT, or CSSLP.\n\nExperience building or maturing an AppSec program from an early stage.\n\nScripting or automation experience (Python, Go, Terraform, or infrastructure-as-code tool like Terraform.\n\nRed team experience performing internal campaigns and providing remediation reports\n\nBenefits\nCompetitive pay with equity options\n\nStellar health care plan options (Medical, Dental & Vision), with FSA, DCFSA, & HSA options\n\nCompany-sponsored disability & life insurance\n\nUnlimited PTO\n\n401(k) + 4% Matching\n\nFully remote work + flexible working hours\n\n$750 work-from-home setup budget\n\nPaid biannual in-person company summits\n\nQuarterly $150 co-hanging stipend to meet up with coworkers\n\nMonthly $100 health and wellness benefit\n\nGenerous paid family leave\n\nAnnual $1,200 learning & development stipend\n\nAbout Turquoise Health\nTurquoise Health is a Series C price transparency platform for finance leaders across healthcare. Backed by a16z, Oak HC/FT, Adams Street, Yosemite, Bessemer Venture Partners, and others, we power price transparency for 300+ enterprise organizations and are building the infrastructure for a more open, efficient healthcare marketplace. We're a remote-first, US-based team that values transparency, empathy, inclusivity, creativity, and ownership.\nWe operate on US business hours and work with clients entirely based in the US. For this role, we are seeking US-based candidates.\nWe strongly encourage BIPOC, people with disabilities, and LGBTQIA+ folks to apply for any open roles of interest. Healthcare affects all people differently, but it significantly affects those in underserved communities. With a robust, diverse team, we are stronger and better equipped to change the future of healthcare for all.\nWork Authorization\nThis role requires current authorization to work in the United States. Turquoise does not sponsor employment visas (H-1B, PERM, etc.) or assume sponsorship of existing visas for this position.\nDisability Accommodation Email\nTurquoise is committed to providing reasonable accommodations to applicants and employees with disabilities. Please tell us if you require a reasonable accommodation to apply for a job or to perform your job. Examples of reasonable accommodation include making a change to the application process or work procedures, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment. If you require assistance or an accommodation with the hiring process, please contact \nNote: All official communication from Turquoise will come from a @turquoise.health email address and all open roles are listed at turquoise.health/careers. We never ask candidates for payment or financial information. If you're contacted by anyone using a different domain, please disregard and report it as spam.","description_format":"text","description_chars":5336,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible schedule","Life insurance","Parental leave","Unlimited PTO"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Health Data & Interoperability"],"lifecycle":[{"event":"open","at":"2026-10-03T00:53:04Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"green card filings: 1","filings_12m":0,"filings_prev_12m":0,"green_card_filings_12m":1,"median_offered_wage_usd":47500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":20,"expected_fill_days":74,"reasons":["conf:4","velocity","win:early","comp:attention"],"computed_at":"2026-10-23T05:54:15Z"},"pay":{"stated_usd_annual":200000,"is_top_pay":true},"html_url":"https://alion.io/job/turquoise-health-senior-application-security-engineer","json_url":"https://alion.io/job/turquoise-health-senior-application-security-engineer.json","meta":{"generated_at":"2026-10-23T23:48:21Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7433,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":179689},"rest":"https://alion.io/mcp/rest/get_company?id=179689"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fturquoise-health-senior-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fturquoise-health-senior-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fturquoise-health-senior-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/turquoise-health-senior-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fturquoise-health-senior-application-security-engineer"}]}