Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 8 hours ago

Security Engineer

Cala Health10 open roles

Pay
$155,000 – $190,000 a year
Where
United States
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSecurity EngineerCala Health · United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Cala Health's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.5% of postings close within 7 days. Measured by our own scanner across the market. Cala Health postings stay open a median of 68 days.

Share of postings closed within
  1. 2.3%1 day
  2. 4.6%3 days
  3. 13.5%7 days
  4. 21.8%14 days
  5. 36.6%30 days
  6. 58.9%60 days
This job: posted 8 hours ago

Cala Health median: 68 days open

The posting

About Cala

At Cala, we’re working to free people from the burden of chronic disease. We began by creating the first non-invasive prescription therapy for hand tremor. After years of careful fine-tuning and improvements, we recently released kIQ® Plus, our most sophisticated therapy yet. Our products have empowered thousands of people to get back to their lives with confidence and ease.

But we won’t stop there. Our pioneering technology can be applied across neurology, cardiology, and beyond. It’s all part of our mission to help people in their struggle with chronic disease. We’re only just getting started

The Opportunity

We are seeking a hands-on Security Engineer embedded within our engineering organization. In this role, you will be the primary technical authority securing our AWS cloud architecture, modern CI/CD pipelines, and web/connected applications. You will bridge software engineering, DevOps, and security—shifting security left into our build pipelines and ensuring our cloud posture remains audit-ready for SOC 2 and healthcare compliance standards.This is an engineering role, not an IT or corporate security role. The ideal candidate writes code, manages AWS infrastructure controls, integrates automated tooling into Jenkins and GitHub Actions CI/CD workflows, and partners directly with software engineers across the entire Software Development Life Cycle (SDLC).

Title: Security Engineer (Cloud & AppSec) Reports to: Staff DevOps Engineer Location: Remote, but if local to San Mateo, CA - Hybrid Employment type: Full-Time, Exempt Pay range: $155,000 - $190,000

Final compensation is based on experience, skills, market benchmarks, and internal equity, with potential adjustments for candidate location.

AWS Cloud Security & Infrastructure Hardening

  • Architect, implement, and monitor security controls across our AWS environment using native tooling (AWS GuardDuty, AWS Inspector, Security Hub, IAM Access Analyzer, KMS, and CloudTrail).
  • Define and enforce least-privilege IAM policies, VPC network isolation, and encryption in transit and at rest.
  • Use Infrastructure as Code (IaC) security tooling to proactively identify and prevent cloud misconfigurations before deployment.

DevSecOps & CI/CD Pipeline Security

  • Embed automated security gates into developer workflows and CI/CD pipelines (Jenkins, GitHub Actions, or GitLab CI) using SAST, DAST, and SCA scanning.
  • Own Software Composition Analysis (SCA) to identify vulnerable dependencies, manage container image scanning, and secure build artifacts against software supply chain risks.
  • Build automation scripts (Python, Bash) to automate vulnerability triage, evidence gathering, and security remediation workflows across build environments.

Application Security & Vulnerability Remediation

  • Review application code, cloud architectures, and pull requests to identify OWASP Top 10 vulnerabilities, auth flaws, and logic bugs early in development.
  • Scope and manage external penetration tests and bug bounty programs; validate findings and partner directly with engineering squads to write and verify technical remediation fixes.
  • Secure APIs and backend endpoints interfacing with connected medical devices and client applications.

Compliance Automation & Audit Readiness (SOC 2 / HIPAA)

  • Serve as the primary technical interface for SOC 2 Type II and HIPAA audits, partnering with DevOps to maintain technical security controls and automated evidence collection.
  • Leverage continuous compliance and posture management platforms (e.g., Vanta) to ensure production cloud infrastructure continuously meets audit baselines without manual overhead.

Engineering Incident Response

  • Investigate security alerts generated from AWS GuardDuty, Inspector, and production infrastructure logs.
  • Lead root-cause analysis (RCA) for application-level and cloud-level security events and build automated prevention mechanisms so the same class of incident cannot recur.

Qualifications & Skills

Required Experience

  • 3+ years of hands-on experience in Cloud Security, Application Security (AppSec), or DevSecOps within a production cloud-native engineering environment.
  • Deep AWS Security Expertise: Hands-on experience configuring and operating AWS native security services (GuardDuty, Inspector, Security Hub, AWS Config, IAM policies, and VPC security).
  • CI/CD Security Automation: Proven background integrating automated security checks (SAST, SCA, container scanning) into build pipelines using Jenkins and modern CI systems (e.g., GitHub Actions, GitLab CI).
  • Compliance in Cloud Environments: Direct experience implementing, maintaining, and gathering automated evidence for technical controls in SOC 2 Type II audits (familiarity with platforms like Vanta is a major plus).
  • Application Security Fundamentals: Strong understanding of OWASP Top 10, CWE, secure authentication/authorization, and modern API security patterns.
  • Scripting & Automation: Proficiency in Python or Shell scripting (Bash) to automate security tooling, query APIs, and parse logs.

Preferred Qualifications

  • Experience with Infrastructure as Code (IaC) and static analysis tools (e.g., Terraform).
  • Familiarity with additional programming languages used by our engineering team (Python, Javascript).
  • Experience with IoT or connected device ecosystems (device provisioning, mutual TLS, secure key rotation, and OTA update pipelines).
  • Relevant industry certifications (e.g., AWS Certified Security – Specialty, AWS Solutions Architect, OSCP, or equivalent practical certifications).

Applicants must be authorized to work in the United States on a full-time basis, or eligible for work authorization through a sponsorship path that Cala Health is able to support. Sponsorship decisions are made individually based on role, timeline, and cost considerations, and are not guaranteed.

Cala Health believes our success is based on diversity of people, teams and thinking. We offer all employees the tools, training and mentoring they need to succeed. Our selection process is driven by the key requirements for the role rather than bias or discrimination on the basis of a candidate’s sex, gender identity, age, marital status, veteran status, non-jobrelated disability/handicap or medical condition, family status, sexual orientation, religion, color, ethnicity, race or any other legally protected classification.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Cala Health's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Cala Health's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Cala Health's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.