About the role
About OpenLoop OpenLoop was co-founded by CEO, Dr. Jon Lensing, and COO, Christian Williams, with the vision to bring care anywhere. Our telehealth support solutions are thoughtfully designed to streamline and simplify go-to-market care delivery for companies offering meaningful virtual support to patients across an expansive array of specialties, in all 50 states.
About
The Role OpenLoop is looking for a Staff Security Engineer (DevOps Integrations) to join our team remotely. In this role, you will be responsible for being our DevSecOps subject matter expert across the IT, software engineering and product teams. The ideal candidate is someone who has the ability to provide strategic oversight, possesses a wide range of cybersecurity and software engineering technical acumen, and has the ability to think like an attacker to guide us through potential security issues. What You’ll Do: Build relationships with developers and stakeholders to incorporate security principles into engineering design and deployments. Supervise validation in security controls and testing across projects, using SAST, DAST, IAST and RASP tools, documenting any security findings, outlining remediation options and overseeing mitigation. Oversee implementation of defensive practices and countermeasures across infrastructure and applications. Draft and uphold CI/CD security strategy and practices in tandem with other technical team leads. Lead continuous product and application security reviews, focused on secure development practices, threat modeling, vulnerability management, architecture and application security design. Ensure security principles and validations are consistently implemented throughout the CI/CD pipeline by embedding robust, security-focused practices into all automation processes. Attend and participate in product meetings addressing security
requirements for new and existing products. Build services and tools to enable developers and engineers to use security components successfully Simplify automation that applies security inter-workings with CI/CD pipelines. Support the ability to “shift left” and incorporate security early on and throughout the development lifecycle. Communicate vulnerability results to both technical and non-technical stakeholders, focused on risk tolerance and threat to the business, in order to gain support through influential messaging. Leverage vulnerability database sources to understand the weakness, probability and remediation options supplied by vendors Join forces and provision security principles in architecture, infrastructure and code. Regularly research and learn new tactics, techniques and procedures (TTPs). Partner with teams to define key performance indicators (KPIs) and metrics across business units. Ensure regulatory compliance (e.g., PCI, HIPAA, HITRUST, NIST CSF) through effective security controls and processes. Other duties as assigned.
