Security Engineer

Ceresti’s engineering team is writing a lot of code. This role makes sure it is safe: threat modeled, risk evaluated, dependency-checked, and tested by someone who knows how an attacker would approach it.

The Security Engineer is the bridge between the CISO’s office and Engineering. You will sit with developers, read their code, and write your own: security utility tools, automation, logging and parsing scripts, and the integrations that turn raw signal into smarter controls. Security has a front end, a back end, and a lot of scripts, and most of the work is integrating systems and automating the tooling developers already use.

You will also break things on purpose. We want someone who builds attack simulations (using AI and the tools we already run) and uses Dev, QA, and Test as a sandbox to prove where the real gaps are rather than arguing about them in the abstract.

Your main working partner is Engineering. You will occasionally build something IT runs in Microsoft 365 for example, and IT is often the end user of those tools. What You Will DoSecure the code Engineering writes

• Build and maintain threat models for new and existing systems and features, and keep them current as architecture changes.

• Read checked-in code and assess its security. This role reviews code; it does not only review reports about code.

• Own Snyk and Docker Scout: thresholds, findings, and driving remediation with the owning teams.

• Review the software bill of materials for outdated or vulnerable components and push fixes through to closure.

• Review SAST and DAST output, prioritize what matters, and work the remediation with engineers directly. Write security tooling and automation

• Build security utility tools and automation that Engineering and the wider company use.

• Write scripts for logging, data parsing, and signal enrichment that make controls smarter rather than noisier.

• Integrate security systems with developer tooling so the safe path is the convenient one.

• Build and tune detection logic and automation that the Security Analyst operates day to day. Prove the gaps are real

• Build penetration tests and attack simulations using AI and the tools we already run, and use Dev, QA, and Test as a test bed to demonstrate real exposure.

• Feed results from Pentest-Tools and internal testing back into what you build next.

• Scope, coordinate, and manage the independent third-party penetration test required for SOC 2 and HITRUST, and track findings to closure. Shape the architecture

• Contribute to security architecture and standards, as well as detection logic.

• Represent security in engineering initiatives including the mobile app, tablet software, the data lake, and AI and machine-learning work.

• Help secure the production cloud environment (AWS via Aptible) as part of Engineering’s platform, as code wherever possible. What Success Looks Like

In the first year, we would expect to see:

• Threat models exist for the major systems and stay current as architecture changes.

• Dependency and container findings from Snyk and Docker Scout are triaged accurately and driven to closure, not just reported.

• Engineering consults you early on mobile, tablet, data lake, and AI work.

• Security tooling you wrote is in day-to-day use, and detections reach the Security Analyst with low noise.

• Attack simulations have surfaced at least one real gap that nobody had argued for on paper.

• The annual third-party penetration test is scoped, scheduled, and tracked to closure. What You BringRequired

• Five to seven years in software or security engineering. Not a first engineering job.

• You write code comfortably and would be at home on a development team. Python, Go, or similar.

• Hands-on application security: threat modeling, dependency and container scanning, and reading code for security flaws.

• Working knowledge of cloud security in AWS, and of CI/CD pipelines and where security fits in them.

• Offensive fundamentals: you can think like an attacker and build a test that proves a point.

• The ability to explain a finding to an engineer in terms they will act on. Preferred

• Experience with Snyk, Docker Scout, or comparable SAST, SCA, and container tooling.

• Detection engineering: writing and tuning rules that hold up in production.

• An OSCP-type certification, or equivalent demonstrable offensive work.

• Healthcare, or another environment handling regulated data.

• Experience in a company where security was being built rather than inherited. How you work

• You like to experiment, and you want a test bed rather than permission.

• You want help thinking through architecture, and you will ask for it. This role has room to grow into that., Employment is contingent on successful completion of a background check, consistent with applicable law., Blockchain * eCommerce * Fintech * Payments * Software * Financial Services * Cryptocurrency Build and maintain network edge security systems that improve API security posture, detect and mitigate abusive traffic, and respond to emerging threats. Responsibilities include developing streaming analytics pipelines, integrating CDN and security vendors, managing production systems, contributing to machine learning models, and implementing AI-driven traffic classification. The role requires software or security engineering experience, expertise in Java, Kotlin, TypeScript, Python, SQL, Spark, CDN platforms, and AWS. Top Skills: AWSCdnCloudflareDatabricksDatadogDynamoDBFastlyJavaKafkaKotlinMySQLPysparkPythonSnowflakeSparkSQLTerraformTypescriptWaf MongoDB

Secure software and cloud environments through threat modeling, code review, vulnerability remediation, security automation, detection engineering, and attack simulations. The role partners closely with Engineering, manages Snyk and Docker Scout findings, integrates security into CI/CD, coordinates third-party penetration testing for SOC 2 and HITRUST, and helps define secure architecture for mobile, data lake, AI, and production cloud systems. The summary above was generated by AI About Ceresti, * You would rather demonstrate a gap, then document it so it gets fixed.

• You treat engineers as colleagues to work alongside, not as an audience to review. What We Offer

• Full-time remote work

• Competitive base salary with final offer based on experience, skills, and location

• Comprehensive health, dental, and vision benefits

• Equity participation in a growing healthcare technology company

• PTO and a culture that respects it

• A collaborative, mission-driven environment where your work directly supports family caregivers and improves outcomes for people living with dementia, Yesterday Remote or Hybrid 179K-205K Annually Senior level 179K-205K Annually Senior level Fintech * Machine Learning * Payments * Software * Financial Services Leads the design and delivery of cloud and on-premises security platforms, automated controls, IAM, endpoint, network, and data protection solutions. Develops automation for vulnerability management, detection, and compliance monitoring; advises on incident response and forensics; embeds security into enterprise platforms; evaluates security technologies; establishes engineering standards; and supports security tools through investigation and troubleshooting. Top Skills: Aws CloudformationAws Security SpecialtyCi/CdCidproCisspCloud SecurityData ProtectionDevsecopsEndpoint SecurityForensicsGiac Cloud SecurityIamIncident ResponseInfrastructure As CodeJavaJavaScriptNetwork SecurityProxy TechnologiesPythonRemote Access SolutionsSecure Web Gateways (Swg)Serverless ComputingTerraformVulnerability Management Block, United States Easy Apply 162K-439K Annually Expert/Leader 162K-439K Annually Expert/Leader Big Data * Cloud * Software * Database Serve as a hands-on technical security leader addressing complex product, infrastructure, architecture, and risk challenges. Evaluate security across compute, network, and storage; influence cross-functional decisions; lead M&A diligence and partner risk assessments; mentor senior individual contributors; and build a technical security community across product, enterprise, and security operations. Top Skills: AIAWSCompute ArchitectureGCPAzureMongoDBNetwork ArchitectureSecurity EngineeringStorage Architecture

What you need to know about the Colorado Tech Scene

With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation.

Key Facts About Colorado Tech

• Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
• Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
• Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
• Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
• Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
• Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute

Ceresti is on a mission to reduce avoidable hospitalizations and improve care for people living with dementia while improving the lives of their families and caregivers. We envision a world in which family caregivers of people living with dementia are supported and have the knowledge, skills, and confidence to provide the best possible care for their loved ones.

Ceresti is a tech-enabled dementia care provider with a differentiated model of care that improves outcomes and delivers guaranteed cost savings by including family caregivers in the care team. We offer health plans and accountable care organizations a turnkey solution for engaging a population that has limited participation in traditional clinical programs.

Our culture is rooted in agility, innovation, and collaboration. We believe every idea-no matter how small-can spark a meaningful improvement. Together, we create solutions that make a lasting impact on the healthcare ecosystem, enabling more compassionate and cost-effective care for those who need it most.