About the role
ABOUT
THE ROLE: Rightway is hiring a Staff Security Engineer, reporting to the Head of Security, to raise the security maturity of the systems, services, and AWS estate that support a better healthcare experience for our members, clients, and partners. This is a senior individual contributor role for an engineer who operates comfortably across product, platform, and cloud domains and can serve as the technical anchor for security engineering.
The role is expected to provide architectural judgment, hands-on execution, and day-to-day leadership for the Application Security and Cloud Security functions while helping
the team scale with consistency. This person will work closely with Engineering, Product, Cloud, and Corporate Security to shape how security controls are selected, implemented, measured, and improved across the company. It is well suited for someone who wants broad scope, visible ownership, and the opportunity to guide both technical decisions and team development in a modern healthcare environment. WHAT YOU’LL DO: Direct the daily execution of the Application Security and Cloud Security functions, balancing near-term delivery, technical quality, and team development. Establish technical priorities, decision frameworks, and operating expectations for two security disciplines so work is sequenced effectively and aligned to business risk. Architect and deploy defensive controls for LLM- and AI-enabled capabilities, including protections around prompt handling, retrieval paths, model-connected integrations, sensitive data exposure, and abusive use patterns. Assess software, services, dependencies, infrastructure, and deployment patterns to identify material weaknesses and drive practical corrective actions with engineering partners. Raise the resilience of Rightway's AWS footprint across identity boundaries, network segmentation, key management, service configuration, organizational structure, and detective guardrails. Expand automation for cloud and platform assurance, including infrastructure policy enforcement, configuration review, deployment gating, and runtime visibility in Terraform and CI/CD workflows. Set the approach for risk-based prioritization by combining severity, exploit likelihood, business criticality, and environmental context so the most meaningful issues are addressed first. Define durable secure engineering expectations that teams can adopt during design, build, test, and release activities without adding unnecessary friction. Work with Product and Engineering leaders to shape secure implementation patterns for new platform capabilities, customer-facing features, and AI-driven functionality before those designs are broadly adopted. Run deep technical reviews for major initiatives, including new services, cloud patterns, external integrations, and emerging architectures that introduce novel attack surface. Guide authentication, authorization, and trust-boundary decisions for business-critical workflows, including SAML 2.0, OAuth, and OIDC use cases spanning B2B and B2C contexts. Unify application and cloud control strategy in areas such as secrets usage, identity design, telemetry, service-to-service trust, and deployment architecture so security decisions remain coherent across the stack. Coordinate with Corporate Security where shared capabilities such as logging, alerting, access governance, or incident visibility require common design and operational support. Improve the signal quality of detection, validation, and testing approaches so teams can investigate faster and act on higher-confidence findings. Evaluate, pilot, and operationalize advanced security capabilities, including AI-enabled techniques that improve engineering review, analysis, and remediation outcomes.
