Turquoise Health

Senior Application Security Engineer

Undisclosed

Remote. The employer does not say where candidates may be based.

Location not stated

Employer listed it 3 weeks ago · Added 3 weeks ago

Been open since 3 weeks ago, still being checked, but it has been live a while.

Salary

$172k to $200k per year

Location

Location not stated

Timezone

Not stated

Contract

Full-time

Experience

Senior

What the advert says

Quoted word for word from the employer's advert. Where it says nothing, we say so.

Working hours: Fully remote work + flexible working hours
Where you can work from: We're a remote-first, US-based team that values transparency, empathy, inclusivity, creativity, and ownership.
Contract: Not mentioned in the advert
Experience asked for: 5+ years of experience in application security, security engineering, or a related software engineering role with a security focus.
Pay: Quarterly $150 co-hanging stipend to meet up with coworkers

Remote flexibility

Undisclosed

The listing is advertised as remote but does not state which countries or regions candidates may work from.

Why this role is Undisclosed

We only label a role Work from anywhere, Region restricted or Work from home when the employer's own wording says so. We checked this advert under our current rules and found no country or region eligibility requirement in it. We don't guess, so it stays Undisclosed until the employer publishes enough location information. Here is exactly what the advert left out.

Countries you can work from: Not stated. The advert only gives "Remote", which names no country you must live in.
Whether the work is remote: Confirmed by the employer: "This is a fully remote role in the United States."
Working hours: Not stated. No timezone overlap or set hours are mentioned, so assume nothing either way.

Worth a look all the same. Missing wording is usually a rushed job posting rather than a closed door, so ask where you can be based in your first message, before you write a tailored application.

What the employer says

Source listing states candidate location: "Remote"

What Nomaders makes of it

No residency or region requirement found in the job description
Check with the employer before assuming you can work from abroad

The quotes above are the employer's own words; the reading is ours. Always check the original listing and employment terms before working from another country.

Before you apply

Experience: employer states

Written as a nice-to-have

“Experience with cloud environments (AWS preferred) and securing modern CI/CD pipelines.”

Questions worth asking: Nomaders interpretation

The advert does not say whether this is employment or a contractor arrangement. Ask, as it affects tax and benefits.

Produced automatically from this advert's text; not reviewed by a person. The employer's own page is the final word.

About the role

This is a fully remote role in the United States.

Turquoise is hiring a Senior Application Security Engineer to drive security for the applications and data our customers rely on. This role owns application-layer security across Turquoise's platform and is the software counterpart to our infrastructure security. You'll build and tune our code scanning program, driving vulnerabilities from discovery to remediation. Day to day, you'll work closely with engineering teams on the design, architecture, and services our product teams build.

What You'll Do

Build and run our application security scanning program (SAST, DAST, dependency/SCA, container and IaC scanning), tuning tools to reduce noise and surface real risk.

Triage findings from scans, penetration tests, and bug bounty reports; prioritize by risk and track remediation through to closure.

Partner with engineering teams to fix vulnerabilities, including hands-on debugging and code-level guidance when needed.

Build trust and cooperation with engineering, product, and design teams so security is considered early in the process, not bolted on at the end (mature SDLC, CI/CD pipelines).

Perform threat modeling and maintain secure-coding standards.

Support incident response for application-layer security issues.

Coordinate and help manage third-party penetration tests.

Track and report on security posture metrics (open vulnerabilities, remediation SLAs, scan coverage) to engineering and leadership.

What You'll Bring

5+ years of experience in application security, security engineering, or a related software engineering role with a security focus.

Hands-on experience with SAST, DAST, and dependency/SCA scanning tools, and the judgment to distinguish real risk from noise.

Deep understanding of common vulnerability classes (OWASP Top 10, authentication/authorization flaws, injection, SSRF, etc.), including the ability to review code and architecture to spot these issues and propose effective fixes.

Experience with cloud environments (AWS preferred) and securing modern CI/CD pipelines.

Strong communication skills, able to explain risk and remediation steps clearly to engineers and non-security stakeholders alike.

A collaborative, pragmatic approach to security that balances risk reduction with shipping velocity.

Nice to Have

Experience in healthcare, fintech, or another regulated industry.

Experience working within compliance frameworks such as HIPAA, SOC 2, or GDPR.

Security certifications such as OSCP, GWAPT, or CSSLP.

Experience building or maturing an AppSec program from an early stage.

Scripting or automation experience (Python, Go, Terraform, or infrastructure-as-code tool like Terraform.

Requirements

·5+ years of experience in application security, security engineering, or a related software engineering role with a security focus.
·Hands-on experience with SAST, DAST, and dependency/SCA scanning tools, and the judgment to distinguish real risk from noise.
·Experience with cloud environments (AWS preferred) and securing modern CI/CD pipelines.
·Strong communication skills, able to explain risk and remediation steps clearly to engineers and non-security stakeholders alike.
·A collaborative, pragmatic approach to security that balances risk reduction with shipping velocity.

Benefits

·Competitive pay with equity options
·Stellar health care plan options (Medical, Dental & Vision), with FSA, DCFSA, & HSA options
·Company-sponsored disability & life insurance
·401(k) + 4% Matching
·Fully remote work + flexible working hours

How to apply

1Check the flexibility label above, undisclosed, matches where you plan to live and work.
2Tailor your CV to the role at Turquoise Health, mentioning your remote working experience.
3Apply directly on the employer's careers page using the button below. Nomaders never handles your application.

Found 25d ago. Last checked today. Always confirm the details on the original posting, salary and location can change after publication.

Listing sourced from Company boards.