Headway

Security Engineer (Product)

Undisclosed

Remote. The employer does not say where candidates may be based.

Location not stated

Employer listed it 3 weeks ago · Added 3 weeks ago

Been open since 3 weeks ago, still being checked, but it has been live a while.

Salary

$223k to $279k per year

Location

Location not stated

Timezone

Not stated

Contract

Full-time

Experience

Mid

What the advert says

Quoted word for word from the employer's advert. Where it says nothing, we say so.

Working hours: Not mentioned in the advert
Where you can work from: Location eligibility not confirmed
Contract: Not mentioned in the advert
Experience asked for: Have 0 → 1 security experience: You have 2+ years experience in security and/or software engineering roles with a demonstrated history of working on security-related projects or with responsibilities as a security generalist.
Pay: Not mentioned in the advert

Remote flexibility

Undisclosed

The listing is advertised as remote but does not state which countries or regions candidates may work from.

Why this role is Undisclosed

We only label a role Work from anywhere, Region restricted or Work from home when the employer's own wording says so. We checked this advert under our current rules and found no country or region eligibility requirement in it. We don't guess, so it stays Undisclosed until the employer publishes enough location information. Here is exactly what the advert left out.

Countries you can work from: Not stated. The advert only gives "Remote", which names no country you must live in.
Whether the work is remote: Never mentioned. The role reached us through a remote job board, but the advert itself doesn't say the work is remote.
Working hours: Not stated. No timezone overlap or set hours are mentioned, so assume nothing either way.

Worth a look all the same. Missing wording is usually a rushed job posting rather than a closed door, so ask where you can be based in your first message, before you write a tailored application.

What the employer says

Source listing states candidate location: "Remote"

What Nomaders makes of it

No residency or region requirement found in the job description
Check with the employer before assuming you can work from abroad

The quotes above are the employer's own words; the reading is ours. Always check the original listing and employment terms before working from another country.

Before you apply

Experience: employer states

Written as a requirement

“Have 0 → 1 security experience: You have 2+ years experience in security and/or software engineering roles with a demonstrated history of working on security-related projects or with responsibilities as a security generalist.”
“Strong technical depth and breadth: You have technical experience with building secure platforms and products at a deep level.”

Questions worth asking: Nomaders interpretation

The advert does not say where you can be based. Ask which countries they can legally employ or contract you from.
The advert does not say whether this is employment or a contractor arrangement. Ask, as it affects tax and benefits.

Produced automatically from this advert's text; not reviewed by a person. The employer's own page is the final word.

About the role

1 in 4 people in the US have a treatable mental health condition, but most providers don't accept insurance, making therapy too expensive for most people. Headway’s mission is to fix this by building a new mental healthcare system everyone can access. We started by solving the biggest barrier to care: insurance. The admin work - credentialing, claims, payment reconciliation - is a nightmare. We've automated that.

But we're going further. Over 90,000 providers across all 50 states run their practice on our software, serving over 2.6 million patients. We are building the best tools for therapists to run their entire practice, reimagining the experience of finding a therapist, and investing in the platform foundations to enable this at scale, and building much of it with AI. We aren't just a billing layer; we are becoming the platform where care actually happens.

We're a Series D company with $325M+ in funding (a16z, Accel, Spark Capital, etc.), looking for exceptional people to help us achieve this mission. We want your time here to be the most meaningful experience of your career. Join us, and help change mental healthcare for the better.

About the role

The Security team at Headway is focused on security and privacy for all of Headway’s customers - therapists, patients, and payers (ex: insurance companies and health systems). As an early member on the team, you’ll have the unique opportunity to be the builder and driver of our dedicated, in-house product and application security engineering efforts. In this role, you will partner closely with our product and engineering teams to ensure that our application is designed and developed securely so that we can maintain and grow customers’ trust in Headway.

What you’ll do at Headway:

Partner with Product and Engineering: Headway has many new product launches on the horizon that will transform the industry and have a rich data component. You will be a partner at both the design and development stage to ensure that we implement new features securely, including (but not limited to):

Participating in the implementation efforts

Doing security reviews

Helping with product design decisions

Auditing and surfacing vulnerabilities in our current products

Build agentic security tooling: Move beyond rules-based automation to agentic workflows that address potential code problems at scale across our rapidly growing codebase. You'll help build an AI-native product security at Headway.

Make the safe way, the easy way: Work on defining and building application guardrails so that developers can build securely by default. You also will work to instill a culture of secure development across engineering.

Assist in ongoing security operations: You will be part of the security team and have responsibilities to assist in incident response, vulnerability management, penetration testing, security reviews, and other operational tasks to ensure that our security program is operating at a world-class level.

Tools we use:

Cloud Security: Lacework

Languages: Python 3, TypeScript

Libraries: FastAPI, SQLAlchemy, React

Datastores: Postgres, Redis

Infrastructure: AWS (Fargate, ECS, S3, and more), Spark and Kafka

Monitoring: Datadog, PagerDuty

Version Control: Github

Vulnerability Management: Snyk, Semgrep

You’ll be great for this role if you have:

Requirements

·Strong cross-functional experience: You love partnering with other teams to help both teams achieve their goals.
·Excited by AI’s potential: You believe AI will fundamentally reshape how product security works, and you want to be at the forefront of making that happen.
·Thrive in ambiguity: You love tackling ambiguous problems in a fast-paced environment with an optimistic and energizing attitude.
·Innovation at Scale: You seek opportunities to lead the industry in implementing the latest security and privacy technologies.
·Results driven: You care deeply about creating impact and driving results for Headway’s business.

Benefits

No benefits package published with this listing. Ask about it at first interview.

How to apply

1Check the flexibility label above, undisclosed, matches where you plan to live and work.
2Tailor your CV to the role at Headway, mentioning your remote working experience.
3Apply directly on the employer's careers page using the button below. Nomaders never handles your application.

Found 19d ago. Last checked today. Always confirm the details on the original posting, salary and location can change after publication.

Listing sourced from Company boards.