Application Security Engineer at Twinhealth

Twin Health At Twin Health, we empower people to improve and prevent chronic metabolic diseases, like type 2 diabetes and obesity, with a new standard of care. Twin Health is the only company applying AI Digital Twin technology exclusively toward metabolic health. We start by building a dynamic model of each person’s metabolism — drawing on thousands of data points from CGMs, smartwatches, and meal logs — that maps their personal path to better health. Guided by a dedicated clinical care team, our members have lowered their A1C below the diabetes range, achieved lasting weight loss, and reduced or even eliminated medications, all while living healthier, happier lives. Working here Our team at Twin Health is passionate, talented, and united by a shared purpose: to improve the metabolic health and happiness of our members. We believe in empowering every Twin to make a meaningful impact for our members, our clients, and each other, while enjoying a supportive, collaborative work environment. Twin has been recognized not only for our innovation but also for our culture, including: Innovator of the Year by the Employer Health Innovation Roundtable (EHIR), selected to CB Insights’ Digital Health 150, and named one of Newsweek’s Top Most Loved Workplace® . With more than $100 million raised in recent funding, including a $53 million Series E round in 2025 led by Maj Invest, and a $50 million investment in 2023 led by Temasek, Twin is scaling rapidly across the U.S. and globally. Backed by leading venture firms like ICONIQ Growth, Sequoia, Sofina, Temasek, and Peak XV, we are building the most impactful digital health company in the world. Join us as we reinvent the standard of care in metabolic health. Opportunity We are seeking a highly motivated Application Security Engineer to join our growing security organization. This role will be instrumental in building and managing our application and cloud security capabilities from the ground up, ensuring Twin Health’s systems and products remain secure as we scale globally. You will work hands-on with a modern technology stack including AWS Security Hub, GuardDuty, Inspector, and Macie, while leading the implementation of a Cloud Security Posture Management (CSPM) solution through Wiz. You will also own our secure code scanning and vulnerability management pipeline, driving continuous improvement across SAST, DAST, and SOAR Cloud integrations. This is a highly technical and strategic role suited for someone who thrives in building systems from scratch, automating workflows, and influencing secure development practices across engineering teams. Candidates must be located in EST. Responsibilities • Design, implement, and manage application and cloud security tooling across AWS, including Security Hub, GuardDuty, Macie, Inspector, and related automation. • Lead the deployment and configuration of Wiz CSPM, collaborating with infrastructure and DevOps teams to enhance visibility and remediation workflows • Manage secure code scanning processes, integrating SAST (Static Analysis) and DAST (Dynamic Analysis) using Sonar Cloud to identify and remediate vulnerabilities early in the SDLC. • Develop automated pipelines and playbooks for vulnerability triage, remediation tracking, and reporting of metrics. (MTTD, MTTR) • Partner with software engineering teams to embed security into CI/CD pipelines and promote secure coding practices. • Collaborate with the Security, IT, and GRC teams to ensure alignment with SOC 2, HIPAA, and SOX controls. • Contribute to threat modeling, code review, and incident response related to application vulnerabilities. • Evaluate and implement new security tools and processes to enhance the overall application security posture. • Support vendor risk assessments and penetration testing efforts related to application components. • Create and maintain security documentation, architecture diagrams, and operational runbooks. • Participate in on-call rotations as part of the broader security operations program. • Other duties as assigned Qualifications • Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent experience). • 1-3+ years of experience in Application Security, DevSecOps, or Cloud Security Engineering roles. • Hands-on experience with AWS security services (Security Hub, GuardDuty, Inspector, Macie, IAM, KMS). • Familiarity with Wiz or similar CSPM platforms. • Proven experience integrating SAST/DAST tools (e.g., Soar Cloud, Veracode, Snyk, Checkmarx, Burp Suite, etc.) into CI/CD pipelines. • Familiarity with Docker, K8S, and microservices-based architectures. • Experience with WAF, endpoint security, and IAM • Strong understanding of secure software development lifecycle (SSDLC) and common vulnerabilities (OWASP Top 10, CWE, CVSS). • Proficiency in at least one scripting or automation language (Python, Bash, or similar). • Proficiency in Java • Knowledge of threat modeling, code review, and cloud infrastructure security best practices. • Excellent collaboration and communication skills with both technical and non-technical stakeholders. • Experience with compliance frameworks such as SOC 2, HIPAA, or HiTrust is a plus. • Experience working in a high-growth or regulated environment is preferred. • This remote opportunity based out of the U.S. and located in EST. Applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time. Compensation and Benefits The compensation range for this position is $110,000 - $120,000 annually. Twin has an ambitious vision to empower people to live healthier and happier lives, and to achieve this purpose, we need the very best people to enhance our cutting-edge technology and medical science, deliver the best possible care, and turn our passion into value for our members, partners and investors. We are committed to delivering an outstanding culture and experience for every Twin employee through a company based on the values of passion, talent, and trust. We offer comprehensive benefits and perks in line with these principles, as well as a high level of flexibility for every Twin • A competitive compensation package in line with leading technology companies • A remote and accomplished global team • Opportunity for equity participation • Unlimited vacation with manager approval • 16 weeks of 100% paid parental leave for delivering parents; 8 weeks of 100% paid parental leave for non-delivering parents • 100% Employer sponsored healthcare, dental, and vision for you, and 80% coverage for your family; Health Savings Account and Flexible Spending Account options • 401k retirement savings plan We have been made aware of fraudulent interview requests being sent using the Twin Health's name. All communications will come from official Twin Health channels and a twinhealth.com email address. We will never ask you to complete a text interview or request financial details during the interview process.