TherapyNotes, LLC
TherapyNotes, LLC
51 – 200 Employees
ConsultingHealthcareLegal
TherapyNotes, LLC develops practice management software for behavioral health professionals, including psychologists, therapists, psychiatrists, and social workers. Its integrated platform brings together scheduling, telehealth, electronic health records, billing, and client portal tools to help mental health practices manage clinical and administrative work in one secure system. The company combines customer support with ongoing product development informed by feedback from the professionals who use its software.

Cybersecurity Engineer, Application Security (Pennsylvania Remote)

Secure TherapyNotes’ behavioral health SaaS applications throughout the SDLC and CI/CD pipelines. Lead vulnerability management, cloud security, and healthcare compliance efforts.

Description

  • Lead application security throughout the software development lifecycle and CI/CD pipeline
  • Work with development teams to embed security practices throughout the SDLC and CI/CD workflows
  • Apply secure coding standards and practices that safeguard customer data confidentiality, integrity, and availability
  • Conduct security assessments, code reviews, and threat modeling exercises
  • Manage GitHub Advanced Security and investigate code, secret, and dependency-scanning findings
  • Analyze recurring vulnerability trends and propose organization-wide remediation approaches
  • Expand scanning coverage while refining security configurations and workflows
  • Protect CI/CD pipelines and GitHub Actions by securing identities, runners, permissions, and secrets
  • Limit software supply-chain exposure through action reviews, dependency controls, action pinning, and artifact provenance
  • Assess Terraform and other infrastructure-as-code for security weaknesses
  • Work with IT platform teams to advance IaC scanning and secure deployment practices
  • Map application security controls to HIPAA, HITRUST, and HITECH requirements and assist with recurring audits
  • Partner with developers to resolve vulnerabilities through effective patching or mitigation
  • Build, deploy, and maintain SAST, DAST, and vulnerability management solutions
  • Assist with application security incident response, root-cause analysis, and remediation planning
  • Help deliver secure-coding awareness initiatives for development teams
  • Support wider security engineering activities spanning vulnerability management, incident response, and identity and access security

Requirements

  • A bachelor’s degree in information security, computer science, or a related discipline is preferred, though equivalent experience may be considered
  • At least five years of experience in application security or security engineering
  • Hands-on experience securing CI/CD pipelines and GitHub Actions, including SAST and DAST, code/secret/dependency finding triage, runner and workflow permissions, and third-party action supply-chain risks
  • Experience identifying security misconfigurations in Terraform or other infrastructure-as-code
  • Working knowledge of SIEM, EDR/XDR, and DLP platforms, including deployment, tuning, and alert investigation
  • Understanding of Zero Trust architecture and its application to application security and identity access
  • Strong knowledge of HIPAA, HITECH, and HITRUST requirements as they affect application security
  • Experience with API security, especially integrations involving other healthcare systems
  • Previous experience securing cloud environments; Azure is preferred and AWS is advantageous
  • Availability to participate in an incident response on-call rotation
  • Certifications such as GWAPT, OSWE, GPEN, or Azure/AWS cloud security credentials are desirable; CISSP or HCISPP is a plus but does not replace hands-on tooling experience
  • Familiarity with HL7 or comparable healthcare data standards is preferred

Benefits

  • Employer-funded health, dental, vision, life, and disability coverage
  • Retirement plan featuring a company contribution
  • Annual company profit-sharing program
  • Budget for personal development and professional training
  • Collaborative and open workplace culture
  • Structured two-week onboarding program
  • Comprehensive mentorship program

Related Jobs