Information Security Engineer

Bamboo Health is the leader in Real-Time Care Intelligence™ solutions aimed at improving lives for everyone experiencing physical and behavioral health challenges. We are driven by our mission to empower clients to deliver seamless, high-quality and cost-effective care during pivotal moments to improve health outcomes. From coast to coast, Bamboo Health partners with all major retail pharmacy chains, 52 states and territories, 100% of the top 10 best hospitals and more than half of the country’s largest health plans to improve more than 1 billion patient encounters annually. Join us in improving lives during pivotal care moments! 

Summary:

The Bamboo Health Information Security Team is seeking a motivated Information Security Engineer to join our Security Operations team. In this role, you will be a key partner throughout the software development lifecycle, helping secure our customer-facing and internal applications. Your work will focus on vulnerability management, including web application penetration testing, along with cloud security, security automation, and digital forensics and incident response (DFIR). You will also participate in the team’s incident response on-call rotation.

This position offers exposure to all aspects of a mature, multi-layered information security program and provides the opportunity to continually expand your skillset. You will collaborate closely with experienced security professionals as well as our infrastructure, IT, and software development teams.

What You’ll Do:

• Manage infrastructure, container, web, API, and mobile application vulnerabilities through dynamic application security testing (DAST), penetration testing, threat modeling, and risk analysis.
• Secure applications hosted in cloud environments and highly automated Kubernetes platforms.
• Support incident response processes, including event monitoring, forensics, containment, and remediation.
• Develop and maintain security automation to streamline operations, including detection engineering and tooling.
• Contribute to internal security awareness initiatives and promote adoption of security best practices across the organization.
• Partner with development teams to embed and advocate for security best practices throughout the software development lifecycle (SDLC).
• Participate in an on-call rotation to escalate, investigate, and remediate security incidents.

What Success Looks Like…

In 3 months…

• Develop comprehensive expertise in Bamboo Health’s security operations by learning and mastering our tools, systems, policies, procedures, and internal documentation.
• Conduct initial vulnerability scans and assist with supervised web application penetration testing.
• Participate in the Security Operations on-call rotation and be comfortable with incident response activities and procedures.
• Assist with planning and executing initial phishing simulations, familiarize yourself with training materials, and track early phishing performance metrics.

In 6 months…

• Independently perform comprehensive web application testing (DAST) and web application penetration testing activities.
• Independently manage and refine the phishing training program by designing simulations, implementing automation, analyzing results, and implementing iterative improvements for better engagement.
• Assist in processing access control requests.
• Start developing basic automation scripts for routine security tasks.
• Contribute to enhancing the software development life cycle with tailored security best practices.

In 12 months…

• Lead comprehensive system and web application vulnerability management—including regular penetration testing programs—and escalate findings to internal teams.
• Understand key cloud security and compliance toolsets.
• Identify areas where automation of security operations could improve existing procedures and implement the changes.

What You Need:

• Bachelor’s degree in Computer Science, Information Security, IT, or a related discipline, or 5+ years of equivalent professional experience in Information Security
• Hands-o