Security Engineer

Join RVO Health as a Security Engineer and play a crucial role in enhancing our security posture and protecting sensitive data. In this collaborative Agile environment, you will design, implement, and maintain security controls for our cloud infrastructure, applications, and data. You will also improve our cloud security posture, build software supply chain controls, extend security into CI/CD pipelines, and perform security assessments. Additionally, you will participate in a weekly on-call rotation for managed detection and response escalations and develop and maintain security standard operating procedures and policies.

• Design, implement, and maintain security controls and architectures to protect the company's cloud infrastructure, applications, and data from cyber threats.
• Improve our cloud security posture and vulnerability management program — pull-request scanning, triage and tracking of findings to closure across engineering teams, and coverage and license optimization.
• Build and enforce software supply chain controls across the developer toolchain — package, dependency, and extension guardrails, with enforcement thresholds tuned to reduce noise rather than generate it.

• Working knowledge of secure coding practices
• Strong problem-solving and analytical skills, with the ability to think critically and make sound decisions
• Hands-on experience with cloud security posture management or CNAPP tooling (e.g., Wiz, Orca, Prisma Cloud), and a track record of driving vulnerability findings to closure with engineering teams
• Experience building security automation, tooling, and integrations, with working proficiency in at least one scripting or programming language
• Solid understanding of cloud security principles, architectures, and services (AWS or Azure preferred)
• Bachelor's degree in Computer Science, related field OR equivalent experience
• Knowledge of security frameworks, standards, and regulations (e.g., NIST CSF, HIPAA, MITRE ATT&CK)
• Minimum 4+ years of experience in application security, cloud security, or a related cybersecurity role
• Experience in incident response and recovery
• Expertise in AWS security controls, monitoring, and orchestration (SCPs, GuardDuty, Config, Macie, etc.)
• Professional certifications (e.g., CISSP, CCSP, OSCP, GIAC)
• Working familiarity with Terraform, GitHub, and DevSecOps workflows — particularly securing GitHub Actions and other CI/CD pipelines
• Experience with internal developer platforms or portals (e.g., Backstage)
• Experience securing AI- or LLM-assisted development workflows, or reviewing AI-generated code at scale
• Experience working alongside an MDR or managed SOC provider