Security Engineer

Location: Hybrid 3 days (offices in NYC, Denver, CO and Charlotte, NC area)

Position Summary

Reporting to the Director of Security Engineering, this Security Engineer role is a hands-on role responsible for securing Judi Health’s cloud environments and the applications that run in them. This role sits at the intersection of cloud security and application security: hardening cloud infrastructure and infrastructure as code, building automation that enforces and evidences security controls, and partnering with software engineering teams to identify and remediate application-layer risk.  

Judi Health operates a FedRAMP Moderate platform in addition to SOC 1, SOC 2, HITRUST, and HIPAA obligations. The engineer in this role will work inside that authorization boundary every day — maintaining continuous monitoring, contributing to continuous control validation and automated compliance evidence, and supporting change management and external assessments. This is a strong fit for an engineer who wants to build durable security capability in a regulated, cloud-native environment rather than operate tools in isolation.  

Position Responsibilities:

• Design, implement, and improve security controls across our cloud infrastructure, platform services, and supporting integrations, including identity and access management, network segmentation, logging, encryption, and key and secrets management.
• Harden infrastructure as code and cloud deployment pipelines, reviewing Terraform and CI/CD changes for security impact and building preventative guardrails rather than after-the-fact findings.   
• Operate and tune cloud security tooling — CSPM/CNAPP, SIEM, vulnerability management, and endpoint and data protection platforms — and drive consolidation toward a unified, well-instrumented approach.  
• Triage, prioritize, and drive remediation of cloud misconfigurations, vulnerabilities, and posture findings, working directly with platform, infrastructure, and engineering owners through to closure.  
• Contribute to detection engineering and incident response, including alert development and tuning, investigation, threat hunting, containment support, and documentation of findings and root cause.  
• Review application and service designs for authentication, authorization, input validation, data exposure, and secrets-handling risk, and participate in architecture and design reviews for new Judi capabilities.  
• Assess code changes for security impact with enough fluency in Python and modern JavaScript frameworks to recognize unsafe patterns and propose practical fixes.  
• Embed security into the software development lifecycle through dependency scanning, secrets detection, container image scanning, and enforcement of pipeline security gates.