Senior Security Engineer – Vulnerability Management & Penetration Testing

Truveta provides unprecedented real-world data and real-time intelligence, powered by a dataset built with and owned by US health systems united in a mission of Saving Lives with Data. Together, we power breakthrough medical discoveries, accelerate regulatory-grade evidence, and improve patient care. Today, Truveta enables research on more than 130 million de-identified patients across the US.

Achieving Truveta’s ambitious mission requires an incredible team of talented and inspired people with a special combination of health, software and big data experience who share our company values .

** Role Overview **

We are looking for a **Senior ** ** Security Engineer ** to drive ** vulnerability management and penetration testing ** across applications and infrastructure.

This role is focused on ** hands-on identification, validation, and remediation of security issues ** , with an emphasis on building scalable processes and improving overall security posture.

** Key Responsibilities **

• Own and operate the ** vulnerability management lifecycle ** , including:

• Continuous scanning (applications, infrastructure, dependencies)

• Risk-based prioritization

• Tracking and driving remediation

• Perform ** penetration testing ** on web applications, APIs, and cloud environments.

• Validate and triage vulnerabilities to eliminate false positives and ensure actionable findings.

• Partner with engineering teams to ** fix vulnerabilities and prevent recurrence ** .

• Implement and manage tools for:

• SAST, DAST, and dependency scanning

• Infrastructure and container scanning

• Develop ** repeatable testing methodologies and automation ** .

• Conduct ** adversarial testing and exploit validation ** to simulate real-world attack scenarios.

• Track metrics and report on ** risk posture and remediation progress ** .

• Contribute to improving ** secure development practices ** based on findings.

** Required Qualifications **

• 5–9+ years of experience in ** security engineering, vulnerability management, or penetration testing ** .

• Hands-on experience with:

• Web and API security testing

• Common vulnerabilities (OWASP Top 10, misconfigurations, auth flaws)

• Strong understanding of ** attack techniques and exploitation methods ** .

• Experience with ** security scanning tools and frameworks ** .

• Ability to ** analyze and validate vulnerabilities in real-world systems ** .

• Familiarity with ** cloud environments (Azure preferred) ** .

** Preferred Qualifications **

• Experience with ** automating security testing in CI/CD pipelines ** .

• Familiarity with ** container and Kubernetes security ** .

• Experience with ** bug bounty or red teaming ** .

• Relevant certifications (e.g., OSCP, CEH, GWAPT).

** What We’re Looking For **

• Strong ** hands-on tester and problem solver ** .

• Ability to go beyond tools and ** think like an attacker ** .

• Focus on ** impact-driven security ** , not just findings.