Application Security Engineer

Requirements & Controls Translate threats and regulatory obligations into clear, actionable, testable security

requirements . Ensure security

requirements are incorporated into: Architecture decisions Product backlogs Acceptance criteria and definitions of done Define and validate security controls for: Authentication and authorization Encryption and key management Secure session management Protection of PHI and cardholder data SaaS, Compliance & Regulated Environments Provide security engineering leadership for SaaS applications subject to HIPAA and PCI DSS

requirements. Partner with Compliance, Risk, and Audit teams to ensure engineering designs and implementations support regulatory obligations without excessive friction. Ensure compliance

requirements are addressed through engineering controls and testable validation , not manual processes alone. Testing, Validation & Secure SDLC Partner with Quality Engineering and DevSecOps to validate security controls using: Secure code analysis Threat‑driven test scenarios Security regression testing Verify that mitigations identified through threat modeling are correctly implemented and effective prior to release. Support penetration testing, security assessments, and remediation efforts, ensuring findings are resolved sustainably. Collaboration & Influence Influence security posture across teams through technical leadership , not enforcement. Coach engineers on secure design patterns and common security pitfalls. Serve as a key technical contributor during incident response, root‑cause analysis, and security retrospectives. Required

Qualifications 6+ years of experience as a Software Engineer , with strong emphasis on application security . Proven experience securing cloud‑native SaaS applications . Hands‑on experience establishing or enforcing secure coding standards . Strong understanding of: Authentication and authorization failures Secure session management Injection and input validation risks Encryption, key management, and data protection Experience working in Agile development environments . Required Domain Experience Experience supporting HIPAA‑regulated systems , including protection of PHI. Experience working with or supporting PCI DSS‑scoped applications and payment data flows. Understanding of how compliance

requirements translate into practical engineering controls . Preferred Certifications One or more of the following are strongly preferred : CSSLP – Certified Secure Software Lifecycle Professional Cloud security certifications (GCP or equivalent security specialization) Application‑security‑focused certifications (e.g., GWAPT, GWEB) This position is not eligible for immigration sponsorship (e.g. H-1B, TN, or E-3). Applicants must be authorized to work in the United States as a condition of employment. (This is only applicable for US-based positions) If you don’t meet every qualification listed but are excited about our mission and the work described, we encourage you to apply . Inovalon is most interested in finding the best candidate for the job , and you may be just the right person for this or other roles. By embracing inclusion , we enhance our work environment and drive business success. Inovalon strives to provide equal opportunit ies to the communities where we operate and to our clients and everyone whom we serve. We endeavor to create a culture of inclusion in which our associates feel empowered to bring their full, authentic selves to work and pursue their professional goals in an equitable setting. We understand that by fostering this type of culture, and welcoming different perspectives, we generate innovation and growth. Inovalon is proud to be an equal opportunity workplace . We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or v eteran status. We also consider qualified applicants regardless of criminal histories, consistent with legal requirement. To review the legal

requirements, including all labor law posters, please visit this link To review the California Consumer Privacy Statement: Disclosures for California Residents, please visit this link

A meeting lands on your calendar

If they’re a yes, I book the chat. You show up — that’s the whole job-hunt.