Senior Security Engineer (Application & Cloud Security)

About the role

Simple Life, an AI-powered health coaching app, is looking for a hands-on Senior Security Engineer with a strong background in application security and cloud-native infrastructure. You will work directly with Engineering and SRE to design, implement and improve security controls across applications, cloud environments and development pipelines. This is an engineering-first role focused on code, infrastructure and automation, with the main stack written in Go and running on AWS and Kubernetes/EKS.

Key responsibilities

• Improve application security across the SDLC through threat modeling, secure design reviews, code review and automated security testing.
• Implement and maintain security controls in AWS and Kubernetes/EKS, including IAM, network policies, secrets management, workload security and admission control.
• Develop security automation, infrastructure-as-code policies and reusable tooling for engineering teams.
• Investigate vulnerabilities, assess their exploitability and work with engineering teams on remediation.
• Support technical security assessments, penetration testing and remediation of findings.
• Help improve security logging, detection and incident response capabilities.
• Maintain technical controls supporting HIPAA, SOC 2 and other requirements.
• Take security engineering projects from design through implementation, rollout and ongoing improvement.

Required profile

• 5+ years of relevant experience in security engineering, application security, cloud security or software engineering with a security focus.
• Familiarity with HIPAA, SOC 2 or ISO 27001 requirements.
• Strong hands-on experience in application security, cloud security or both.
• Production experience with AWS and Kubernetes.
• Ability to read and write code in Go, Python or a similar language.
• Experience with CI/CD security, infrastructure-as-code, security scanning tools and vulnerability management.
• Comfortable working directly with developers and infrastructure engineers; strong written and spoken English.

Required skills

• Web and API security, authentication, authorization and common application vulnerabilities.
• IAM, cloud networking, secrets management and container security.
• Ability to independently investigate technical problems and implement practical solutions.

A plus: offensive security, penetration testing or bug bounty experience; Istio, mTLS and Kubernetes network policies; Kyverno, OPA, Cilium; supply-chain security tooling such as Cosign, Sigstore or Syft.