Staff Security Engineer

ABOUT THE ROLE: Rightway is hiring a Staff Security Engineer, reporting to the Head of Security, to raise the security maturity of the systems, services, and AWS estate that support a better healthcare experience for our members, clients, and partners. This is a senior individual contributor role for an engineer who operates comfortably across product, platform, and cloud domains and can serve as the technical anchor for security engineering. The role is expected to provide architectural judgment, hands-on execution, and day-to-day leadership for the Application Security and Cloud Security functions while helping the team scale with consistency. This person will work closely with Engineering, Product, Cloud, and Corporate Security to shape how security controls are selected, implemented, measured, and improved across the company. It is well suited for someone who wants broad scope, visible ownership, and the opportunity to guide both technical decisions and team development in a modern healthcare environment. WHAT YOU’LL DO: Direct the daily execution of the Application Security and Cloud Security functions, balancing near-term delivery, technical quality, and team development. Establish technical priorities, decision frameworks, and operating expectations for two security disciplines so work is sequenced effectively and aligned to business risk. Architect and deploy defensive controls for LLM- and AI-enabled capabilities, including protections around prompt handling, retrieval paths, model-connected integrations, sensitive data exposure, and abusive use patterns. Assess software, services, dependencies, infrastructure, and deployment patterns to identify material weaknesses and drive practical corrective actions with engineering partners. Raise the resilience of Rightway's AWS footprint across identity boundaries, network segmentation, key management, service configuration, organizational structure, and detective guardrails. Expand automation for cloud and platform assurance, including infrastructure policy enforcement, configuration review, deployment gating, and runtime visibility in Terraform and CI/CD workflows. Set the approach for risk-based prioritization by combining severity, exploit likelihood, business criticality, and environmental context so the most meaningful issues are addressed first. Define durable secure engineering expectations that teams can adopt during design, build, test, and release activities without adding unnecessary friction. Work with Product and Engineering leaders to shape secure implementation patterns for new platform capabilities, customer-facing features, and AI-driven functionality before those designs are broadly adopted. Run deep technical reviews for major initiatives, including new services, cloud patterns, external integrations, and emerging architectures that introduce novel attack surface. Guide authentication, authorization, and trust-boundary decisions for business-critical workflows, including SAML 2.0, OAuth, and OIDC use cases spanning B2B and B2C contexts. Unify application and cloud control strategy in areas such as secrets usage, identity design, telemetry, service-to-service trust, and deployment architecture so security decisions remain coherent across the stack. Coordinate with Corporate Security where shared capabilities such as logging, alerting, access governance, or incident visibility require common design and operational support. Improve the signal quality of detection, validation, and testing approaches so teams can investigate faster and act on higher-confidence findings. Evaluate, pilot, and operationalize advanced security capabilities, including AI-enabled techniques that improve engineering review, analysis, and remediation outcomes. WHO YOU ARE: You bring roughly 8 to 12 years of experience in security engineering, including substantial hands-on depth across both application or product security and cloud security. You have a track record of leading difficult technical work across multiple security domains and helping other engineers improve through direction, coaching, and example. You stay current on emerging AI security guidance, including the OWASP Top 10 for LLM Applications and the OWASP GenAI Security Project, and have applied that knowledge in real system design. You have strong AWS security expertise across IAM, networking, encryption, secrets protection, logging, and multi-account design, and you know how to secure infrastructure-as-code and modern delivery pipelines. You can operate as a senior technical partner to engineering and infrastructure teams on topics such as identity, service hardening, telemetry, and secure configuration. You can read and reason about application code and system architecture, and you have enough fluency in one or more backend environments such as Ruby, Node.js, or Java to work credibly with developers. You communicate clearly with both technical and non-technical stakeholders and can explain tradeoffs, priorities, and risk to senior leadership. Experience in regulated environments such as healthcare, finance, or education is required. COMPENSATION: $169,000 - $210,000 annually, in addition to bonus and equity Compensation offered will be determined by geographic location, experience, and qualifications. CYBERSECURITY AWARENESS NOTICE In response to ongoing and industry-wide fraudulent recruitment activities (i.e., job scams), Rightway wants to inform potential candidates that we will only contact them from the @ rightwayhealthcare.com email domain. We will never ask for bank details or deposits of any kind as a condition of employment. ABOUT RIGHTWAY: Rightway is on a mission to harmonize healthcare for everyone, everywhere. Our products guide patients to the best care and medications by inserting clinicians and pharmacists into a patient’s care journey through a modern, mobile app. Rightway is a front door to healthcare, giving patients the tools they need along with on-demand access to Rightway health guides, human experts that answer their questions and manage the frustrating parts of healthcare for them. Since its founding in 2017, Rightway has raised over $200mm from investors including Khosla Ventures, Thrive Capital, and Tiger Global. We’re headquartered in New York City, with satellite offices in Denver and Dallas. Our clients rely on us to transform the healthcare experience, improve outcomes for their teams, and decrease their healthcare costs. HOW WE LIVE OUR VALUES TO OUR TEAMMATES: We’re seeking those with passion for healthcare and relentless devotion to our goal. We need team members that embody our core values: 1) We are human, first Our humanity binds us together. We bring the same empathetic approach to every individual we engage with, whether it be our members, our clients, or each other. We are all worthy of respect and understanding and we engage in our interactions with care and intention. We honor our stories. We listen to—and hear—each other, we celebrate our differences and similarities, we are present for each other, and we strive for mutual understanding. 2) We redefine what is possible We always look beyond the obstacles in front of us to imagine new solutions. We approach our work with inspiration from other industries, other leaders, and other challenges. We use ingenuity and resourcefulness when faced with tough problems. 3) We debate then commit We believe that a spirit of open discourse is part of a healthy culture. We understand and appreciate different perspectives and we challenge our assumptions. When working toward a decision or a new solution, we actively listen to one another, approach it with a “yes, and” mentality, and assume positive intent. Once a decision is made, we align and champion it as one team. 4) We cultivate grit Changing healthcare doesn’t happen overnight. We reflect and learn from challenges and approach the future with a determination to strive for better. In the face of daunting situations, we value persistence. We embrace failure as a stepping stone to future success. On this journey, we seek to act with guts, resilience, initiative, and tenacity. 5) We seek to delight Healthcare is complicated and personal. We work tirelessly to meet the goals of our clients while also delivering the best experience to our members. We recognize that no matter the role or team, we each play a crucial part in our members’ care and take that responsibility seriously. When faced with an obstacle, we are kind, respectful, and solution-oriented in our approach. We hold ourselves accountable to our clients and our members’ success. Rightway is proud to be an Equal Opportunity Employer that believes in the strength of diverse thought, beliefs, backgrounds, and education. We foster an inclusive culture where differences are celebrated to drive the best business decisions possible. We do not discriminate on any basis protected by applicable law. All employment decisions are based on merit, qualifications, need, and performance.