HeartFlow

Discussion

Application Security Engineer

Heartflow is a medical technology company advancing the diagnosis and management of coronary artery disease, the #1 cause of death worldwide, using cutting-edge technology. The flagship product—an AI-driven, non-invasive cardiac test supported by the ACC/AHA Chest Pain Guidelines called the Heartflow FFRCT Analysis—provides a color-coded, 3D model of a patient’s coronary arteries indicating the impact blockages have on blood flow to the heart. Heartflow is the first AI-driven non-invasive integrated heart care solution across the CCTA pathway that helps clinicians identify stenoses in the coronary arteries (RoadMap™Analysis), assess coronary blood flow (FFRCT Analysis), and characterize and quantify coronary atherosclerosis (Plaque Analysis). Our pipeline of products is growing and so is our team; join us in helping to revolutionize precision heartcare.

Heartflow is a publicly traded company (HTFL) that has received international recognition for exceptional strides in healthcare innovation, is supported by medical societies around the world, cleared for use in the US, UK, Europe, Japan and Canada, and has been used for more than 500,000 patients worldwide.

We are looking for an Application Security Engineer to work with our engineering team to ensure security is an integral part of our Software Development Lifecycle (SDLC). In this role, you’ll have the chance to use your security and software development background to protect patients as we build products that leverage AI to improve healthcare. If you enjoy working with talented engineers to solve complex technical challenges and want to see your work make a direct difference in patient outcomes, we encourage you to apply. This role is a hybrid, requiring three days a week in our San Francisco office.

What You’ll Do:

  • Partner with the engineering team to provide hands-on technical guidance to software developers throughout the vulnerability remediation lifecycle. Perform secure code reviews, validate false positive determinations, coach developers on effective remediation strategies, threat model our products and carry out essential parts of a secure SDLC.
  • Drive vulnerability identification using SAST, DAST, SCA and in-house AI tooling and manage external penetration testing.
  • Support engineering team on vulnerability management, including risk assessment, remediation, improving identification of vulnerabilities and translate security and privacy requirements into technical requirements.
  • Build security awareness through training on secure coding practices, security standards and latest security threats.

What You Bring:

  • Security Communication – Ability to reason about risk in complex environments and communicate that risk to technical and non-technical audiences. Experience leading training, speaking internally/externally about security projects valued.
  • Programming Skills – Experience writing and maintaining code in at least one modern programming language and with at least one scripting language (Heartflow uses C++/Python). Comfortable with testing frameworks and CI/CD pipelines.
  • AI Development Tools – Experience using AI code tools such as Claude Code and Github Copilot for development and security testing.
  • Education & Experience – BS in Computer Science (or related degree) or relevant certifications and equivalent experience. 5+ years of total experience with at least 1 year working in Application Security or performing security tasks in a development role.
  • Securing SDLC – Have contributed to secure SDLC activities, including threat modeling, code review, security testing and vulnerability management.
  • Knowledge of Modern AI Security Threats – Experience working with or ability to discuss current AI threats for both machine learning and generative AI.

What Helps You Stand Out:

  • Healthcare Experience – Current knowledge of HIPAA, HITRUST and the complexities of working in a regulated environment. Experience with Software as a Medical Device (SaMD) is especially valuable.
  • Infrastructure as Code & Cloud – Familiarity with AWS (or equivalent cloud providers) and configuration tools (Terraform, Chef, Ansible). Experience with containerization (Docker, Kubernetes) and orchestration (GitHub Actions or similar).

A reasonable estimate of the base salary compensation range is $145,000 to $180,000 per year, bonus, and equity. #LI-IB1

Heartflow is an Equal Opportunity Employer. We are committed to a work environment that supports, inspires, and respects all individuals and do not discriminate against any employee or applicant because of race, color, religion, marital status, age, national origin, ancestry, physical or mental disability, medical condition, pregnancy, genetic information, gender, sexual orientation, gender identity or expression, veteran status, or any other status protected under federal, state, or local law. This policy applies to every aspect of employment at Heartflow, including recruitment, hiring, training, relocation, promotion, and termination.
Positions posted for Heartflow are not intended for or open to third party recruiters / agencies. Submission of any unsolicited resumes for these positions will be considered to be free referrals.
Heartflow has become aware of a fraud where unknown entities are posing as Heartflow recruiters in an attempt to obtain personal information from individuals as part of our application or job offer process. Before providing any personal information to outside parties, please verify the following: A) all legitimate Heartflow recruiter email addresses end with “@heartflow.com” and B) the position described is found on our careers site at .
Show

What this application asks

greenhouse

First Name, Last Name, Email, Phone, Resume/CV, Cover Letter, Location

  • LinkedIn Profile optional
  • Are you legally authorized to work in the United States? choose one
  • Will you now or in the future require sponsorship for employment visa status (e.g. F-1 STEM OPT, H-1B, TN, E-3, O-1)? choose one
  • Do you have 5+ years of total experience with at least 1 year working in Application Security or performing security tasks in a development role? choose one
  • If yes, please provide details below. choose one
  • Do you hold an AWS certification choose one
  • What are your base salary expectations for this role?
  • Do you have any immediate family that work at Heartflow? choose one
  • If answered Yes, please provide the name of the employee who works at Heartflow. optional
  • Are any of your immediate family members practicing health care professionals that may use or purchase Heartflow products? choose one
  • If answered Yes, please provide the name of the relative and the name of the organization in which they are employed. optional
  • Have you ever been or currently debarred by the U.S. FDA or excluded by the OIG? choose one
  • Are you currently located within 50 miles from San Francisco? choose one
  • As part of this position, you will be required to be in the San Francisco office 3 days a week. Are you ok with this requirement? choose one
  • If not currently local in the San Francisco Bay Area, are you willing to relocate? choose one
  • Which state do you currently reside in? choose one
  • Please select the only fictional character from the list below to confirm this application is not AI-generated: choose one

See also

99,971 jobs
Python jobs
23,342 jobs
C++ jobs
37,050 jobs
Security jobs
70,730 jobs
AWS jobs
41,112 jobs
Kubernetes jobs
22,682 jobs
Terraform jobs
31,261 jobs
Docker jobs
9,255 jobs
Ansible jobs
8,232 jobs
Remote Worldwide jobs
27,098 jobs
JavaScript jobs

要針對這個職缺調整履歷嗎？

目前無法檢查您與這個職缺的符合程度；請先將履歷加入個人檔案，下次即可查看。

A new version of freehire is available