Product Security Engineer

About us

Qualifications

• You are a developer first: You have substantial experience in software development and are comfortable writing production-ready code (we use Python and Go, but we welcome all backgrounds).
• You are pragmatic: You understand that "perfect" security doesn't exist. You can weigh security risks against business goals and communicate trade-offs effectively to non-security stakeholders.
• You are proactive: You don't wait for a ticket. You look for patterns in vulnerabilities and build systemic fixes or libraries to prevent entire classes of bugs.
• You know the cloud: You have deep familiarity with AWS infrastructure best practices, IAM, and containerization.
• You are a teacher: Your default setting is collaborative, not combative: You're excited about enabling software developers.
• You are fluent in AI: You lean into continuous learning and experimentation. You actively use AI tools in ways that are beneficial to your teammates, improve security research and analysis, and help others practice responsible AI use.
• Experience creating developer-focused security libraries or CLI tools.
• Familiarity with HIPAA, PCI, or securing fintech/payment data.
• Participation in CTFs, bug bounties, or open-source security contributions.
• Applicants must be currently authorized to work in the United States on a full-time basis.
• Compensation Range and Benefits
• Salary Range: $157,250.00 – $198,875.00
• This role is equity eligible
• This role offers a competitive benefits and wellness package
• Subject to location, experience, and education
• What do we offer to the ideal candidate?
• A chance to improve the U.S. healthcare system at a high-growth company! Our leading healthcare financial platform is scaling rapidly, helping millions of patients per year
• Unless stated otherwise, most roles have flexibility to work from home or in the office, depending on what works best for you
• For exempt employees: Unlimited PTO for vacation, sick and mental health days–we encourage everyone to take at least 20 days of vacation per year to ensure dedicated time to spend with loved ones, explore, rest and recharge
• 16 weeks paid parental leave with health benefits for all parents, plus flexible re-entry schedules for returning to work
• Diversity initiatives that encourage Cedarians to bring their whole selves to work, including three employee resource groups: be@cedar (for BIPOC-identifying Cedarians and their allies), Pridecones (for LGBTQIA+ Cedarians and their allies) and Cedar Women+ (for female-identifying Cedarians)
• Competitive pay, equity (for qualifying roles), and health benefits, including fertility & adoption assistance, that start on the first of the month following your start date (or on your start date if your start date coincides with the first of the month)
• Cedar matches 100% of your 401(k) contributions, up to 3% of your annual compensation
• Access to hands-on mentorship, employee and management coaching, and a team discretionary budget for learning and development resources to help you grow both professionally and personally

Preferred Qualifications

• Bonus Points

Responsibilities

• Build Security Tooling: Shift into a development role to architect robust tools in Terraform, Bash, Go, or Python. You’ll use gRPC, GraphQL, and HTTP to build automation that eliminates manual security toil and developer pain.
• Architect for Scale: Grab pairing time with product engineers to co-design features across Cedar. You will help bake security in at the design phase, not bolt it on at the end.
• Pave the Road: Review Infrastructure-as-Code (Terraform) and IAM roles, not just to find flaws, but to offer code-ready improvements that educate developers and streamline future deployments.
• Advise, Don't Block: Serve as a trusted advisor. When you find a vulnerability, you don’t just report it—you help scope the fix based on a pragmatic understanding of the risk and the business context.
• You are a developer first: You have substantial experience in software development and are comfortable writing production-ready code (we use Python and Go, but we welcome all backgrounds).
• You are pragmatic: You understand that "perfect" security doesn't exist. You can weigh security risks against business goals and communicate trade-offs effectively to non-security stakeholders.
• You are proactive: You don't wait for a ticket. You look for patterns in vulnerabilities and build systemic fixes or libraries to prevent entire classes of bugs.
• You know the cloud: You have deep familiarity with AWS infrastructure best practices, IAM, and containerization.
• You are a teacher: Your default setting is collaborative, not combative: You're excited about enabling software developers.
• You are fluent in AI: You lean into continuous learning and experimentation. You actively use AI tools in ways that are beneficial to your teammates, improve security research and analysis, and help others practice responsible AI use.
• Experience creating developer-focused security libraries or CLI tools.
• Familiarity with HIPAA, PCI, or securing fintech/payment data.
• Participation in CTFs, bug bounties, or open-source security contributions.
• Applicants must be currently authorized to work in the United States on a full-time basis.