Application Security Engineer

Role Overview

We are seeking a Staff Software Engineer with a strong focus on application security to serve as a technical leader responsible for embedding security across the design, development, and operation of our cloud‑native SaaS platforms. This role plays a critical part in establishing secure coding standards, and ensuring that security risks, requirements, and controls are effectively implemented, tested, and validated throughout the product lifecycle.

The ideal candidate has hands‑on experience securing SaaS applications operating under HIPAA and PCI compliance requirements, and acts as a trusted partner to Engineering, Architecture, Quality Engineering, DevSecOps, and Compliance teams. This is not a policy‑only or audit‑only role—the Staff Engineer is expected to lead through technical depth, influence, and hands‑on contribution.

Key Responsibilities

Secure Software Engineering & Technical Leadership

• Act as a security engineering subject matter expert across multiple teams or services.

• Establish, document, and evolve secure coding standards, patterns, and best practices for SaaS applications.

• Lead and participate in secure design and code reviews, identifying security flaws, architectural risks, and improper patterns early.

• Collaborate with engineers to remediate vulnerabilities in a maintainable and scalable manner.

• Ensure security considerations are balanced with performance, reliability, and developer productivity.

Risk & Architecture Security

• Identify assets, trust boundaries, attack surfaces, and data flows—including PHI and payment data.

• Define, track, and manage security risks, mitigations, and accepted residual risks as engineering artifacts.

Security Requirements & Controls

• Translate threats and regulatory obligations into clear, actionable, testable security requirements.

• Ensure security requirements are incorporated into:

  • Architecture decisions

  • Product backlogs

  • Acceptance criteria and definitions of done

• Define and validate security controls for:

  • Authentication and authorization

  • Encryption and key management

  • Secure session management

  • Protection of PHI and cardholder data

SaaS, Compliance & Regulated Environments

• Provide security engineering leadership for SaaS applications subject to HIPAA and PCI DSS requirements.

• Partner with Compliance, Risk, and Audit teams to ensure engineering designs and implementations support regulatory obligations without excessive friction.

• Ensure compliance requirements are addressed through engineering controls and testable validation, not manual processes alone.

Testing, Validation & Secure SDLC

• Partner with Quality Engineering and DevSecOps to validate security controls using:

  • Secure code analysis

  • Threat‑driven test scenarios

  • Security regression testing

• Verify that mitigations identified through threat modeling are correctly implemented and effective prior to release.

• Support penetration testing, security assessments, and remediation efforts, ensuring findings are resolved sustainably.

Collaboration & Influence

• Influence security posture across teams through technical leadership, not enforcement.

• Coach engineers on secure design patterns and common security pitfalls.

• Serve as a key technical contributor during incident response, root‑cause analysis, and security retrospectives.

Required Qualifications

• 6+ years of experience as a Software Engineer, with strong emphasis on application security.

• Proven experience securing cloud‑native SaaS applications.

• Hands‑on experience establishing or enforcing secure coding standards.

• Strong understanding of:

  • Authentication and authorization failures

  • Secure session management

  • Injection and input validation risks

  • Encryption, key management, and data protection

• Experience working in Agile development environments.

Required Domain Experience

• Experience supporting HIPAA‑regulated systems, including protection of PHI.

• Experience working with or supporting PCI DSS‑scoped applications and payment data flows.

• Understanding of how compliance requirements translate into practical engineering controls.

Preferred Certifications

One or more of the following are strongly preferred:

• CSSLP – Certified Secure Software Lifecycle Professional

• Cloud security certifications (GCP or equivalent security specialization)

• Application‑security‑focused certifications (e.g., GWAPT, GWEB)

This position is not eligible for immigration sponsorship (e.g. H-1B, TN, or E-3). Applicants must be authorized to work in the United States as a condition of employment. (This is only applicable for US-based positions)

If you don’t meet every qualification listed but are excited about our mission and the work described, we encourage you to apply. Inovalon is most interested in finding the best candidate for the job, and you may be just the right person for this or other roles.

By embracing inclusion, we enhance our work environment and drive business success. Inovalon strives to provide equal opportunities to the communities where we operate and to our clients and everyone whom we serve. We endeavor to create a culture of inclusion in which our associates feel empowered to bring their full, authentic selves to work and pursue their professional goals in an equitable setting. We understand that by fostering this type of culture, and welcoming different perspectives, we generate innovation and growth.

Inovalon is proud to be an equal opportunity workplace. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or veteran status. We also consider qualified applicants regardless of criminal histories, consistent with legal requirement.

To review the legal requirements, including all labor law posters, please visit this link

To review the California Consumer Privacy Statement: Disclosures for California Residents, please visit this link