Get the chrome extension Security Engineer Internship
Metasys
Security Engineer
Overview: Supply Chain Security and Compliance
The Security Engineer is a critical role responsible for implementing and enforcing robust security practices across our entire integrated supply chain e-commerce platform. You will safeguard e-commerce transactions, secure internal tool integrations, and establish the trust framework for our AI agent operations, ensuring compliance with global regulatory standards like PCI-DSS and GDPR.
Internship Details
Duration: 3 months (extendable based on performance and project scope)
Start Date: Immediate
Location: Remote
Stipend: Unpaid initially; may convert to a paid internship, full-time role, or even direct client absorption (FTE) based on your performance
Key Responsibilities & Core Projects
You will secure all layers of the application, from the Next.js frontend to the NestJS modular monolith and the cloud infrastructure.
Security Architecture & Threat Modeling: Perform vulnerability assessments, code reviews, and threat modeling for all new features and systems, focusing on the critical MES $\rightarrow$ WMS $\rightarrow$ OMS business process flow.
Compliance Enforcement: Lead the implementation and auditing of security controls necessary for PCI-DSS compliance (for Payment module) and GDPR compliance (for user/tenant data handling).
Access Control & Authentication: Implement and manage secure API authentication methods, including OAuth 2.0 and SAML, utilizing Authentik/Ory Kratos and leveraging PostgreSQL's Row-Level Security (RLS) for tenant isolation.
Secrets & Encryption: Manage secrets and key rotation using Vault, define and enforce encryption protocols for data both in transit and at rest, and manage certificates via Traefik.
Abuse Prevention: Implement and monitor controls for API rate limiting, Web Application Firewall (WAF) rules, and traffic monitoring to prevent abuse and denial-of-service attacks.
Incident Response: Develop and practice incident investigation and response protocols. Conduct security awareness training for development and operations teams.
Required Technologies & Tools
Candidates must possess hands-on security experience with our core stack and compliance tools:
Platform Security: Node.js/NestJS security best practices, Next.js/React security, PostgreSQL RLS.
Compliance Focus: Experience with PCI-DSS and GDPR controls and auditing.
Authentication & Access: OAuth 2.0, SAML, JWT, Authentik/Ory Kratos.
Secrets & Infrastructure: HashiCorp Vault, Docker, Terraform.
Monitoring & Assessment: Tools for Static/Dynamic Application Security Testing (SAST/DAST).
AI Agent Security
You will be responsible for securing the emerging AI ecosystem.
Agent Trust Framework: Establish security boundaries for the AI agent interfaces, ensuring agents (built with LangChain/AutoGen) operate within strict permissions when accessing supply chain data (WMS, OMS).
Prompt Injection Prevention: Implement validation and sanitization techniques to mitigate prompt injection and data exfiltration risks in user-facing LLM interactions.
Success Metrics & Career Path
Performance will be measured by:
Security Scorecard: Reduction in identified vulnerabilities from assessments and code reviews (SAST/DAST).
Compliance Audits: Successful passing of regular PCI-DSS and GDPR audits.
Incident Handling: Speed and effectiveness of security incident investigation and remediation.
Mentorship Structure: Reports to the Solution Architect or Head of Technology, working closely with the development and DevOps teams to embed security into the CI/CD pipeline.
Originally posted on Himalayas
Senior Security Engineer
AxisCare Home Care Software
Senior Security Engineer
Reports To: Director of Engineering
Summary
AxisCare is hiring a full-time, fully remote Senior Security Engineer to own security and compliance across our SaaS platform, the market-leading product powering the home care industry.
This is not a job where you'll write policies that nobody reads. You'll work directly with product engineering teams, embedded in how we build software, shaping our security posture. You'll own engineering's side of our SOC 2 Type II compliance program, lead us toward HITRUST certification, and keep our AWS infrastructure, Docker pipelines, and PHP/React codebase hardened as we move fast.
We're also building AI-powered products on top of Amazon Bedrock and our own machine learning models, and we use AI heavily in how we develop software. That creates new kinds of risk that most security playbooks don't cover yet. We need someone who's thinking about this already and building the guardrails that agents need to write secure software.
Home care agencies trust us to run their business every day. Their data includes protected health information. We need someone who takes that personally.
What You'll Do
Own AxisCare Engineering's security program as an individual contributor. Continually improve our security standards as threats evolve, strengthen the systems that enforce them, and work directly with engineers to close gaps.
Own engineering's share of SOC 2 Type II compliance: control design, evidence collection, audit prep, and gap remediation. Chart the path toward HITRUST certification, mapping what we already have and building what we don't.
Threat-model our application and infrastructure. We run a PHP/React modular monolith on AWS, managed with Terraform, deployed in Docker containers, backed by MySQL in RDS. Raise the bar on this stack's security (IAM policies, VPC design, secrets management, container security, database access controls) and keep raising it as the architecture evolves.
Own and improve our security scanning program. Tune findings, cut false positives, and make sure scan results turn into developer action.
Assess and mitigate the security risks inherent in our AI products: prompt injection, data leakage, model output filtering, abuse scenarios. Set guardrails for AI-assisted development workflows so the team ships faster without opening new attack surface.
Strengthen our detection and response capabilities: logging, alerting, incident response playbooks. Coordinate penetration tests, track findings, and drive remediation.
Keep our security policies clear, current, and short. Train developers on secure practices without burying them in process.
What We're Looking For
A builder, not just an auditor. You've built or run a security program inside a product company, not just assessed one from the outside. You can point to systems, controls, and habits you put in place that made a real difference.
A technical peer to engineers. You read code, read Terraform, and talk to developers in their language. When you flag a vulnerability, you can explain the fix, not just the finding.
A pragmatist. You understand that we need to ship. You weigh tradeoffs, probability, and impact, not by saying no to everything.
A strong writer. Remote work demands it, and clear writing is clear thinking. You'll write policies, incident reports, audit narratives, and messages to engineers explaining why something matters. Clarity counts.
An AI-aware security thinker. You're already wrestling with what AI means for security: new attack surfaces, new tooling, new ways that development workflows create risk.
Experience required:
- 5+ years in application security, infrastructure security, or security engineering at a SaaS company
- Hands-on experience with AWS security (IAM, VPC, Security Groups, KMS, CloudTrail, GuardDuty)
- Experience owning or heavily contributing to the engineering side of SOC 2 Type II compliance
- Familiarity with container security (Docker, Kubernetes) and infrastructure-as-code (Terraform)
- Solid grasp of web application security fundamentals (OWASP Top 10, secure SDLC)
- Experience securing AI/ML systems or LLM-powered products
- Concrete examples of how you've used AI to improve your own security work: automating compliance tasks, speeding up threat analysis, building detection rules faster, or something we haven't thought of
- Able to work remotely from the Eastern, Central, or Mountain time zones
- Qualified to work in the United States or Canada
What We'd Be Excited to Find
- Experience building or maintaining HIPAA-compliant or HITRUST-certified environments
- CISSP, OSCP, or AWS Security Specialty certification
- Background in penetration testing or red team work
Working Conditions
- Manual dexterity required to use desktop computer and peripherals.
Compensation and Equipment
- Salary (TBD based on job experience and skill level)
- Medical insurance is covered in full for the employee (Medical, Dental, and Vision)
- Company will provide laptop and other needed computer equipment
How to Apply
Apply with a brief resume and either a written or video cover letter.
We review the cover letter before anything else in your application, so this really matters. This is your single biggest opportunity to improve your chances, and video submissions go right to the front of the line.
Prompt: How has AI changed the security landscape you work in: what's gotten easier, what's gotten harder, and how have you adapted? Tell us about a security program, control, or hard problem you're proud of owning. Tell us why this position is the one you've been hoping to find.
Written: No more than 600 words. We're looking for clarity of thought and strong communication. Use AI if you want, but don't send slop.
Video: 1–2 minutes, linked in the "Website, Blog, or Portfolio" section of your application. Doesn't need to be highly produced. We care about how you think and communicate.
We strongly encourage candidates from all backgrounds and every walk of life to apply. Every person on our team brings their own unique perspective, and it's what makes our products better and our work more rewarding. We're eager to support you so that you can ship work you're proud of.
Candidates only. No recruiters, please.
About AxisCare
According to Pew Research, roughly 10,000 baby boomers turn 65 every day, and the American Society on Aging calculated that an American has a 70% chance of needing help with activities of daily living such as dressing, bathing, hygiene, etc. This has led to an unprecedented increase in Home Care agencies in the U.S. and abroad who strive to help those who have difficulty helping themselves, specifically offering non-medical (also referred to as non-skilled) services to seniors in their homes.
AxisCare was started in 2011 by industry leaders to help meet the demand for a more user-friendly and mobile-compatible solution. Our product is a web-based management platform that helps agencies manage CRM and marketing, Caregiver/Client scheduling, billing, payroll and much more. Headquartered in Waco, TX, AxisCare has clients in all 50 states as well as 6 other countries. We are a fast-growing company seeking high-performing individuals looking for a fast-paced, autonomous working environment.
Originally posted on Himalayas
Security Engineer
Ceresti Health
About Ceresti
Ceresti is on a mission to reduce avoidable hospitalizations and improve care for people living with dementia while improving the lives of their families and caregivers. We envision a world in which family caregivers of people living with dementia are supported and have the knowledge, skills, and confidence to provide the best possible care for their loved ones.
Ceresti is a tech-enabled dementia care provider with a differentiated model of care that improves outcomes and delivers guaranteed cost savings by including family caregivers in the care team. We offer health plans and accountable care organizations a turnkey solution for engaging a population that has limited participation in traditional clinical programs.
Our culture is rooted in agility, innovation, and collaboration. We believe every idea—no matter how small—can spark a meaningful improvement. Together, we create solutions that make a lasting impact on the healthcare ecosystem, enabling more compassionate and cost-effective care for those who need it most.
The Role
Ceresti's engineering team is writing a lot of code. This role makes sure it is safe: threat modeled, risk evaluated, dependency-checked, and tested by someone who knows how an attacker would approach it.
The Security Engineer is the bridge between the CISO's office and Engineering. You will sit with developers, read their code, and write your own: security utility tools, automation, logging and parsing scripts, and the integrations that turn raw signal into smarter controls. Security has a front end, a back end, and a lot of scripts, and most of the work is integrating systems and automating the tooling developers already use.
You will also break things on purpose. We want someone who builds attack simulations (using AI and the tools we already run) and uses Dev, QA, and Test as a sandbox to prove where the real gaps are rather than arguing about them in the abstract.
Your main working partner is Engineering. You will occasionally build something IT runs in Microsoft 365 for example, and IT is often the end user of those tools.
What You Will Do
Secure the code Engineering writes
- Build and maintain threat models for new and existing systems and features, and keep them current as architecture changes.
- Read checked-in code and assess its security. This role reviews code; it does not only review reports about code.
- Own Snyk and Docker Scout: thresholds, findings, and driving remediation with the owning teams.
- Review the software bill of materials for outdated or vulnerable components and push fixes through to closure.
- Review SAST and DAST output, prioritize what matters, and work the remediation with engineers directly.
Write security tooling and automation
- Build security utility tools and automation that Engineering and the wider company use.
- Write scripts for logging, data parsing, and signal enrichment that make controls smarter rather than noisier.
- Integrate security systems with developer tooling so the safe path is the convenient one.
- Build and tune detection logic and automation that the Security Analyst operates day to day.
Prove the gaps are real
- Build penetration tests and attack simulations using AI and the tools we already run, and use Dev, QA, and Test as a test bed to demonstrate real exposure.
- Feed results from Pentest-Tools and internal testing back into what you build next.
- Scope, coordinate, and manage the independent third-party penetration test required for SOC 2 and HITRUST, and track findings to closure.
Shape the architecture
- Contribute to security architecture and standards, as well as detection logic.
- Represent security in engineering initiatives including the mobile app, tablet software, the data lake, and AI and machine-learning work.
- Help secure the production cloud environment (AWS via Aptible) as part of Engineering's platform, as code wherever possible.
What Success Looks Like
In the first year, we would expect to see:
- Threat models exist for the major systems and stay current as architecture changes.
- Dependency and container findings from Snyk and Docker Scout are triaged accurately and driven to closure, not just reported.
- Engineering consults you early on mobile, tablet, data lake, and AI work.
- Security tooling you wrote is in day-to-day use, and detections reach the Security Analyst with low noise.
- Attack simulations have surfaced at least one real gap that nobody had argued for on paper.
- The annual third-party penetration test is scoped, scheduled, and tracked to closure.
What You Bring
Required
- Five to seven years in software or security engineering. Not a first engineering job.
- You write code comfortably and would be at home on a development team. Python, Go, or similar.
- Hands-on application security: threat modeling, dependency and container scanning, and reading code for security flaws.
- Working knowledge of cloud security in AWS, and of CI/CD pipelines and where security fits in them.
- Offensive fundamentals: you can think like an attacker and build a test that proves a point.
- The ability to explain a finding to an engineer in terms they will act on.
Preferred
- Experience with Snyk, Docker Scout, or comparable SAST, SCA, and container tooling.
- Detection engineering: writing and tuning rules that hold up in production.
- An OSCP-type certification, or equivalent demonstrable offensive work.
- Healthcare, or another environment handling regulated data.
- Experience in a company where security was being built rather than inherited.
How you work
- You like to experiment, and you want a test bed rather than permission.
- You want help thinking through architecture, and you will ask for it. This role has room to grow into that.
- You would rather demonstrate a gap, then document it so it gets fixed.
- You treat engineers as colleagues to work alongside, not as an audience to review.
What We Offer
• Full-time remote work
- Competitive base salary with final offer based on experience, skills, and location
- Comprehensive health, dental, and vision benefits
- Equity participation in a growing healthcare technology company
• PTO and a culture that respects it
- A collaborative, mission-driven environment where your work directly supports family caregivers and improves outcomes for people living with dementia
Additional Information
Employment is contingent on successful completion of a background check, consistent with applicable law.
Ceresti is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other characteristic protected by law.
Originally posted on Himalayas