How you move is why we’re here. ®
Now more than ever.
Get back to what you need and love to do.
The possibilities are endless...
Now more than ever, our guiding principles are helping us in our search for exceptional talent - candidates who align with our unique workplace culture and who want to maximize the abundant opportunities for growth and success.
If this describes you then let’s talk!
HSS is consistently among the top-ranked hospitals for orthopedics and rheumatology by U.S. News & World Report. As a recipient of the Magnet Award for Nursing Excellence, HSS was the first hospital in New York City to receive the distinguished designation. Whether you are early in your career or an expert in your field, you will find HSS an innovative, supportive and inclusive environment.
Working with colleagues who love what they do and are deeply committed to our Mission, you too can be part of our transformation across the enterprise.
Emp Status
Regular Full time
Work Shift
Compensation Range
What you will be doing
Position Activities
Partner with application development, data and analytics, infrastructure, cloud, architecture, and cybersecurity teams to embed secure-by-design principles into applications, services, pipelines, platforms, and infrastructure.
Design, implement, and maintain security controls within CI/CD pipelines, including automated testing, security gates, build and deployment checks, and risk-based exception workflows.
Manage and support application security capabilities such as Static Application Security Testing (SAST), Software Composition Analysis (SCA), secrets detection, dependency review, and code security scanning using tools such as Snyk, Wiz, and GitHub.
Review application designs, architecture patterns, data flows, APIs, cloud workloads, and integration points to identify security risks and recommend practical remediation or compensating controls.
Support threat modeling, secure code review, and security design reviews throughout the software development lifecycle.
Validate, prioritize, and track remediation of application, cloud, container, infrastructure, and development environment vulnerabilities using platforms such as Snyk, Wiz, Sysdig, Tenable, GitHub, and related tools.
Review cloud resources, Infrastructure as Code templates, container images, and deployment configurations against organizational policies, secure configuration baselines, and industry best practices.
Develop scripts, integrations, dashboards, and automated workflows that improve security testing, vulnerability management, reporting, evidence collection, and developer self-service.
Create metrics, reports, diagrams, runbooks, standards, and technical documentation that communicate application security posture, pipeline security effectiveness, vulnerability trends, and remediation status to technical and non-technical audiences.
Support audits, assessments, compliance activities, and control validation requests related to application security, cloud security, software supply chain security, and secure development practices.
Perform other related duties as assigned.
Minimum Qualifications
Bachelor’s degree in computer science, information technology, cybersecurity, software engineering, data engineering, or a related field, or equivalent experience.
Seven or more years of professional IT experience with five or more years in DevSecOps, application security, cloud security, software engineering, infrastructure engineering, security engineering, or a related technical role.
Working knowledge of secure software development lifecycle practices, application security principles, cloud security concepts, CI/CD security, and vulnerability management.
Experience with CI/CD platforms such as GitHub Actions, Azure DevOps, GitLab CI, Jenkins, or similar tools.
Experience with cloud platforms such as Microsoft Azure, AWS, or similar environments.
Familiarity with application security and software supply chain security capabilities such as SAST,…