[Remote] Senior Software Engineer, Product Security
Note: The job is a remote job and is open to candidates in USA. Pomelo Care is the leading virtual medical practice for women and children, providing care across various stages of life. They are seeking a Senior Software Engineer, Product Security to build automation and tools that integrate security into the software development lifecycle, ensuring the protection of critical systems and patient data.
Responsibilities
- Design and implement auth enhancements such as magic link improvements and access/audit log features to monitor access and improve transparency
- Lead the privacy engineering initiatives including DSAR integration, building automated data deletion capabilities directly into the Pomelo mobile app and our internal platform to ensure seamless compliance
- Own the end-to-end pentest-to-fix lifecycle, triaging reports, writing code to fix penetration test findings, remediating SAST issues, and building systems for high-volume dependency patching with regression testing
- Build secure-by-default libraries to reduce the load on core Software Engineering by creating internal libraries and patterns that make security the default path
- Partner with engineering leads to conduct threat modeling and ensure secure design at the earliest stages of the development process
- Help engineering squads navigate complex security use cases, translating GRC requirements into elegant code rather than manual checklists
Skills
- 5+ years of software engineering experience
- Strong foundation in computer science
- Track record of shipping production-grade code (Python, Go, Kotlin or similar)
- Understanding of the OWASP Top 10
- Understanding of identity flows and prompt injections
- Ability to build systems that eliminate a class of vulnerability
- Experience with practical automation
- Ability to navigate ambiguity and context-switch across various engineering teams
- Ability to build rapport with different engineering teams
- Experience with Google Cloud Platform (GCP)
- Experience with Github Advanced Security (GHAS)
- Experience with Stytch, Sentry, Fullstory, Statsig or similar technology stack
- Prior experience in healthcare data, including understanding of HIPAA, SOC 2 Type 2 and HITRUST compliance requirements
- Experience building data infrastructure that supports AI/ML workloads
- Experience with internal developer platforms and privacy preserving data de-identification and anonymization techniques
- Previous work experience in a fast-paced, product-oriented startup environment
Benefits
- Comprehensive Health, Dental, and Vision coverage for employees and their families
- High deductible Health Plans with Health Savings Account (HSA) options
- Flexible Spending Account (FSA)
- Equity grant participation
- 401(k) program
- Competitive vacation policy
- 16 weeks paid parental leave
- Fully remote work flexibility (within the US)
Company Overview