[Remote] Security Engineer — Application Security & Identity
Note: The job is a remote job and is open to candidates in USA. Real Chemistry is a global agency dedicated to transforming healthcare through scientific expertise and AI-driven insights. The Security Engineer will own application security across multiple environments, ensuring compliance and security controls are enforced, while also partnering with DevOps Engineering to integrate security policies.
Responsibilities
- Conduct security reviews of Internally developed applications including:
- Data flow validation
- Security control design and implementation
- Secrets handling
- AI/LLM Data Loss Prevention (DLP)
- Co-lead production readiness reviews for strictly governed environments:
- Threat modeling
- Hardening validation
- Compliance mapping (SOC 2and contractual and regulatory requirements)
- Define and enforce identity architecture:
- Corporate identity: Entra ID
- Workload identity: AWS IAM and GitHub OIDC
- Define and manage GitHub native security controls:
- GitHub Advanced Security (CodeQL / SAST)
- Dependabot (dependency scanning)
- Secret scanning
- Branch protection and environment controls
- Establish standards for security tooling:
- SAST (CodeQL, Semgrep)
- SCA (Dependabot, Snyk)
- Container scanning (Trivy, ECR scanning)
- Infrastructure as Code (IaC) policy (OPA, Sentinel, tfsec)
- Define AWS security standards:
- IAM design and least-privilege access
- Logging and audit requirements
- Secrets management and rotation
- Scope and coordinate third-party penetration testing
- Maintain audit logging maturity per environment requirements:
- Baseline logging
- User-level activity tracking
- Tamper-evident audit trails with SIEM integration
- Perform initial triage and risk classification within time requirements for critical issues identified in intake (data exposure, credentials, regulatory risk)
- Partner with DevOps Engineering to ensure security policies are implemented in pipelines and infrastructure
- Define approved AI providers and usage boundaries
- Establish prompt data classification and handling policies
- Enforce human-in-the-loop requirements where appropriate
- Define cost/spend guardrails for AI services
Skills
- 5+ years (or 3–5+ in high-growth environments) in cloud security, 2 of which should be focused application security
- Hands-on security experience with: AWS IAM, SAML / OIDC federation, GitHub security tooling
- Experience with threat modeling and coordinating penetration testing
- Familiarity with SOC 2, GDPR, and HIPAA-adjacent controls
- In-depth understanding of the risk lifecycle
- Experience securing GitHub-based CI/CD pipelines
- Experience in AWS native environments
- Exposure to regulated industries (GxP, 21 CFR Part 11)
- Security certifications (CISSP, CCSP, OSCP, GIAC, etc.)
- Associates degree or higher
- Experience bringing low-code or AI-generated applications under enterprise security controls
Benefits
- Comprehensive benefit program and perks, tailored to your region
- Free snacks to keep you running all day long (offices in key markets)
- Generous holiday and paid time off
- Options for private medical, dental, and vison plans
- Support in saving for the future
- Mental wellness coaching and support
- Access to more than 13,000 online classes with LinkedIn Learning
- Real Hybrid and Regional Teams (Real HART) approach designed to foster collaboration, learning, innovation, and meaningful relationships while providing flexibility where appropriate
- For employees located within a one-hour commute of a Real Chemistry office, in-person attendance two days per week
- Employees in regions without a nearby office may work remotely and come together throughout the year for collaboration, culture-building, learning, and team connection opportunities
Company Overview
Company H1B Sponsorship