Senior Security Engineer

Simple Life is the #1 AI-powered health coaching app for adults who want to lose weight and enjoy a healthier lifestyle-without the stress or extremes. Our mission is to empower people to feel their best every day. By challenging traditional, restrictive approaches, Simple offers a more sustainable method grounded in ease, personalization, and real-life support.

Simple has had over 17 million downloads and more than 300,000 5-star reviews, having helped millions lose weight successfully and sustainably. Simple has earned recognition as Best Virtual Coach and one of the Top 100 AI companies — all thanks to a dedicated global team driving real impact.

With SIMPLE as a partner in their pocket, users feel cared for and empowered to embrace - and stick to - new healthy habits. To learn more, visit simple.life.

We are looking for a hands-on Senior Security Engineer with a strong background in application security and cloud-native infrastructure.

You will work directly with Engineering and SRE to design, implement, and improve security controls across our applications, cloud environments, and development pipelines.

This is an engineering-first role. We are looking for someone who is comfortable working with code, infrastructure, and automation rather than relying solely on security tools and processes.

Our main application stack is written in Go and runs on AWS and Kubernetes/EKS.

This is a practical engineering role, so we’re looking for someone comfortable working with code, infrastructure and automation. Security is an independent function, giving you the chance to work across teams, own projects and shape how security is built into our systems.

What you'll do:

• Improve application security across the SDLC through threat modeling, secure design reviews, code review, and automated security testing.

• Implement and maintain security controls in AWS and Kubernetes/EKS, including IAM, network policies, secrets management, workload security, and admission control.

• Develop security automation, infrastructure-as-code policies, and reusable tooling for engineering teams.

• Investigate vulnerabilities, assess their exploitability, and work with engineering teams on remediation.

• Support technical security assessments, penetration testing, and remediation of identified findings.

• Help improve security logging, detection, and incident response capabilities.

• Implement and maintain technical controls supporting HIPAA, SOC 2, and other relevant requirements.

• Take security engineering projects from design through implementation, rollout, and ongoing improvement.

What we're looking for:

• 5+ years of relevant experience in security engineering, application security, cloud security, or software engineering with a security focus.

• Familiarity with HIPAA, SOC 2, or ISO 27001 requirements.

• Strong hands-on experience in application security, cloud security, or both, with a willingness to work across these areas.

• Production experience with AWS and Kubernetes.

• Good understanding of web and API security, authentication, authorization, and common application vulnerabilities.

• Ability to read and write code in Go, Python, or a similar language.

• Experience with CI/CD security and infrastructure-as-code.

• Experience working with security scanning tools and vulnerability management.

• Understanding of IAM, cloud networking, secrets management, and container security.

• Ability to independently investigate technical problems and implement practical solutions.

• Comfortable working directly with developers and infrastructure engineers.

• Strong written and spoken English.

Would be a plus:

• Offensive security experience, penetration testing, or bug bounty work.

• Experience with Istio, mTLS, and Kubernetes network policies.

• Experience with Kyverno, OPA, Cilium, or similar technologies.

• Experience with supply-chain security tooling such as Cosign, Sigstore, or Syft.