Note: The job is a remote job and is open to candidates in USA. Pomelo Care is the leading virtual medical practice for women and children, providing care across various life stages. They are seeking a Senior Software Engineer in Product Security to build automation, tools, and workflows that integrate security into the software development lifecycle, while ensuring the protection of patient data and systems.
Responsibilities
- Design and implement auth enhancements such as magic link improvements and access/audit log features to monitor access and improve transparency
- Lead the privacy engineering initiatives including DSAR integration, building automated data deletion capabilities directly into the Pomelo mobile app and our internal platform to ensure seamless compliance
- Own the end-to-end pentest-to-fix lifecycle by writing the code to fix penetration test findings, remediating SAST issues, and building greenkeeping systems for high-volume dependency patching with regression testing
- Build secure-by-default libraries to reduce the load on core Software Engineering by creating internal libraries and patterns that make security the default path
- Partner with engineering leads to conduct threat modeling and ensure secure design at the earliest stages of the development process
- Help engineering squads navigate complex security use cases, translating GRC requirements into elegant code rather than manual checklists
Skills
- You have 5+ years of software engineering experience and are ready to pivot to a full-time security role, bringing a strong foundation in computer science and a track record of shipping production-grade code (Python, Go, Kotlin or similar)
- You understand the OWASP Top 10, identity flows and prompt injections, but you'd rather build a system that eliminates a class of vulnerability than manually triage individual alerts
- You believe security expertise should be embedded into the development process, not bolted on at the end
- You enjoy tackling complex problems with practical automation and are keeping up with trends in LLM agents to multiply your engineering impact
- You are comfortable context-switching and can quickly build rapport with different engineering teams to understand their needs
- Have experience with Google Cloud Platform (GCP), Github Advanced Security (GHAS), Stytch, Sentry, Fullstory, Statsig or similar technology stack
- Have prior experience in healthcare data, including understanding of HIPAA, SOC 2 Type 2 and HITRUST compliance requirements
- Have experience building data infrastructure that supports AI/ML workloads, internal developer platforms and privacy preserving data de-identification and anonymization techniques
- Have previously worked in a fast-paced, product-oriented startup environment
Benefits
- Comprehensive Health, Dental, and Vision coverage for employees and their families
- High deductible Health Plans with Health Savings Account (HSA) options
- Flexible Spending Account (FSA)
- Equity grant participation
- 401(k) program
- Competitive vacation policy
- 16 weeks paid parental leave
- Fully remote work flexibility (within the US)
Company Overview