Information Security Engineer

Bamboo Health is the leader in Real-Time Care Intelligence solutions aimed at improving lives for everyone experiencing physical and behavioral health challenges. We are driven by our mission to empower clients to deliver seamless, high-quality and cost-effective care during pivotal moments to improve health outcomes. From coast to coast, Bamboo Health partners with all major retail pharmacy chains, 52 states and territories, 100% of the top 10 best hospitals and more than half of the country's largest health plans to improve more than 1 billion patient encounters annually. Join us in improving lives during pivotal care moments!

Summary:

The Bamboo Health Information Security Team is seeking a motivated Information Security Engineer to join our Security Operations team. As an Information Security Engineer, you will be a key partner in the software development life cycle to secure customer-facing applications. You will focus on vulnerability management, including web application penetration testing, as well as cloud security, security automation, and digital forensics and incident response. You will participate in an incident response rotation. This role will provide you with exposure to all aspects of a mature information security program with the opportunity to expand your skillset.

You will analyze potential risks to the organization's information systems and data, secure customer-facing and internal applications, and investigate security incidents. The Information Security Engineer will work with seasoned information security experts, infrastructure and IT teams, and software development teams.

What You'll Do:

• Manage infrastructure, container, web, API, and mobile application vulnerabilities through dynamic application security testing (DAST), penetration testing, and threat modeling and analysis.
• Secure applications hosted in cloud and highly automated Kubernetes environments.
• Engage in incident response processes including event monitoring, forensics, and incident remediation.
• Develop automation processes to streamline security operations including performing detection engineering.
• Assist with the team's efforts with our internal security awareness program and security best practices.
• Promote and integrate security best practices across the software development life cycle.
• Participate in the on-call rotation to escalate and remediate security incidents as they arise.

What Success Looks Like...

In 3 months...

• Develop comprehensive expertise in Bamboo Health's security operations by learning and mastering our tools, systems, policies, procedures, and internal documentation.
• Conduct initial vulnerability scans and assist with supervised web application penetration testing.
• Participate in the Security Operations on-call rotation and be comfortable with incident response activities and procedures.
• Assist with planning and executing initial phishing simulations, familiarize yourself with training materials, and track early phishing performance metrics.

In 6 months...

• Independently perform comprehensive web application testing (DAST) and web application penetration testing activities.
• Independently manage and refine the phishing training program by designing simulations, implementing automation, analyzing results, and implementing iterative improvements for better engagement.
• Assist in processing access control requests.
• Start developing basic automation scripts for routine security tasks.
• Contribute to enhancing the software development life cycle with tailored security best practices.

In 12 months...

• Lead comprehensive system and web application vulnerability management-including regular penetration testing programs-and escalate findings to internal teams.
• Understand key cloud security and compliance toolsets.
• Identify areas where automation of security operations could improve existing procedures and implement the changes.

What You Need:

• Bachelor's degree in Computer Science, Information Security, IT, or related discipline, or 5+years equivalent professional experience in Information Security
• Hands-on vulnerability management experience
• Hands-on web application testing (DAST) and/or pen testing experience
• Intermediate knowledge of Linux, macOS, and Windows
• Basic knowledge of cloud services such as AWS, Azure, or GCP
• Domain familiarity in fields such as incident response and digital forensics, endpoint security and securing cloud-centric or Kubernetes environments
• Excellent written and verbal communication skills, with ability to build and communicate business rationale
• Working knowledge of common vulnerability management, endpoint protection, and/or SIEM tooling
• Working knowledge of incident response best practices
• Intermediate knowledge of cloud services such as AWS, Azure, or GCP
• Professional experience with security audits and compliance frameworks
• Intermediate understanding of scripting languages (Python, PowerShell, bash)
• Security or cloud certifications or other evidence of security-related achievements
• A high level of judgment, analytical ability and creativity in investigating problems that require original and innovative solutions
• Experience working a fast-paced, high-growth, rapidly changing work environments
• Strong analytical and problem-solving skills, with a high level of judgment and creativity in designing innovative solutions.
• Demonstrated ability to thrive in fast-paced, high-growth, and rapidly evolving environments.
• Ability to work effectively in a remote-first environment, ensuring high-quality virtual interactions with minimal distractions.

What You Get:

• Join one of the most innovative healthcare technology companies in the country.
• Have the autonomy to build something with an enthusiastically supportive team.
• Learn from working at the highest levels and on the most strategic priorities of the company, including from world class investors and advisors.
• Receive competitive compensation including health, dental, vision and other benefits.

Belonging at Bamboo

We Care. #BambooHealthValuesCare

Every human being has the right to the best possible healthcare. Our Real-Time Care Intelligencesolutions enable healthcare professionals to see and treat every individual as a whole person by providing the right information, at the right time - regardless of physical, behavioral or social barriers.

We're a great place to work because we care. We continually seek to learn about our differences and ensure the unique perspectives and contributions of all employees are welcome, valued and celebrated.

Our commitment to making a positive impact starts by recognizing and leveraging our differences, building inclusive teams and cultivating a sense of belonging.

Bamboo Health is proud to provide equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.