Security Engineer (Product)

The Security team at Headway is focused on security and privacy for all of Headway’s customers - therapists, patients, and payers (ex: insurance companies and health systems). As an early member on the team, you’ll have the unique opportunity to be the builder and driver of our dedicated, in-house product and application security engineering efforts. In this role, you will partner closely with our product and engineering teams to ensure that our application is designed and developed securely so that we can maintain and grow customers’ trust in Headway.

What you’ll do at Headway:

• Partner with Product and Engineering: Headway has many new product launches on the horizon that will transform the industry and have a rich data component. You will be a partner at both the design and development stage to ensure that we implement new features securely, including (but not limited to):
• Participating in the implementation efforts
• Doing security reviews
• Helping with product design decisions
• Auditing and surfacing vulnerabilities in our current products
• Build agentic security tooling: Move beyond rules-based automation to agentic workflows that address potential code problems at scale across our rapidly growing codebase. You'll help build an AI-native product security at Headway.
• Make the safe way, the easy way: Work on defining and building application guardrails so that developers can build securely by default. You also will work to instill a culture of secure development across engineering.
• Assist in ongoing security operations: You will be part of the security team and have responsibilities to assist in incident response, vulnerability management, penetration testing, security reviews, and other operational tasks to ensure that our security program is operating at a world-class level.
• Cloud Security: Lacework
• Languages: Python 3, TypeScript
• Libraries: FastAPI, SQLAlchemy, React
• Datastores: Postgres, Redis
• Infrastructure: AWS (Fargate, ECS, S3, and more), Spark and Kafka
• Monitoring: Datadog, PagerDuty
• Version Control: Github
• Vulnerability Management: Snyk, Semgrep

…