About
Simple Life is an AI-powered health coaching app that helps adults lose weight and build healthier habits through a sustainable approach based on personalization and real-life support. The app has had over 17 million downloads and more than 300,000 five-star reviews.
Responsibilities
•Improve application security across the SDLC through threat modeling, secure design reviews, code reviews, and automated security testing
•Implement and maintain security controls in AWS and Kubernetes/EKS, including IAM, network policies, secrets management, workload security, and admission control
•Develop security automation, infrastructure-as-code policies, and reusable tools for engineering teams
•Investigate vulnerabilities, assess their exploitability, and work with engineering teams on remediation
•Support technical security assessments and penetration testing, and remediate identified findings
•Improve security logging, detection, and incident response capabilities
•Implement and maintain technical controls supporting HIPAA, SOC 2, and other relevant requirements
•Take security engineering projects from design through implementation, rollout, and ongoing improvement
Requirements
•5+ years of relevant experience in security engineering, application security, cloud security, or software engineering with a security focus
•Familiarity with HIPAA, SOC 2, or ISO 27001 requirements
•Hands-on experience in application security, cloud security, or both, and willingness to work across these areas
•Production experience with AWS and Kubernetes
•Good understanding of web and API security, authentication, authorization, and common application vulnerabilities
•Ability to read and write code in Go, Python, or a similar language
•Experience with CI/CD security, infrastructure-as-code, security scanning tools, and vulnerability management
•Understanding of IAM, cloud networking, secrets management, and container security
•Ability to independently investigate technical problems and implement practical solutions
•Comfortable working directly with developers and infrastructure engineers
•Strong written and spoken English
Nice to have
•Offensive security experience, penetration testing or bug bounty work
•Experience with Istio, mTLS and Kubernetes network policies
•Experience with Kyverno, OPA, Cilium or similar technologies
•Experience with supply-chain security tooling such as Cosign, Sigstore or Syft
Conditions
No conditions specified in the posting.
