Security Engineer

About Cala At Cala, we’re working to free people from the burden of chronic disease. We began by creating the first non-invasive prescription therapy for hand tremor. After years of careful fine-tuning and improvements, we recently released kIQ® Plus, our most sophisticated therapy yet. Our products have empowered thousands of people to get back to their lives with confidence and ease. But we won’t stop there. Our pioneering technology can be applied across neurology, cardiology, and beyond. It’s all part of our mission to help people in their struggle with chronic disease. We’re only just getting started The Opportunity We are seeking a hands-on Security Engineer embedded within our engineering organization. In this role, you will be the primary technical authority securing our AWS cloud architecture, modern CI/CD pipelines, and web/connected applications. You will bridge software engineering, DevOps, and security—shifting security left into our build pipelines and ensuring our cloud posture remains audit-ready for SOC 2 and healthcare compliance standards.This is an engineering role, not an IT or corporate security role. The ideal candidate writes code, manages AWS infrastructure controls, integrates automated tooling into Jenkins and GitHub Actions CI/CD workflows, and partners directly with software engineers across the entire Software Development Life Cycle (SDLC). Title: Security Engineer (Cloud & AppSec) Reports to: Staff DevOps Engineer Location: Remote, but if local to San Mateo, CA - Hybrid Employment type: Full-Time, Exempt Pay range: $155,000 - $190,000 Final compensation is based on experience, skills, market benchmarks, and internal equity, with potential adjustments for candidate location. AWS Cloud Security & Infrastructure Hardening • Architect, implement, and monitor security controls across our AWS environment using native tooling (AWS GuardDuty, AWS Inspector, Security Hub, IAM Access Analyzer, KMS, and CloudTrail). • Define and enforce least-privilege IAM policies, VPC network isolation, and encryption in transit and at rest. • Use Infrastructure as Code (IaC) security tooling to proactively identify and prevent cloud misconfigurations before deployment. DevSecOps & CI/CD Pipeline Security • Embed automated security gates into developer workflows and CI/CD pipelines ( Jenkins , GitHub Actions , or GitLab CI) using SAST, DAST, and SCA scanning. • Own Software Composition Analysis (SCA) to identify vulnerable dependencies, manage container image scanning, and secure build artifacts against software supply chain risks. • Build automation scripts (Python, Bash) to automate vulnerability triage, evidence gathering, and security remediation workflows across build environments. Application Security & Vulnerability Remediation • Review application code, cloud architectures, and pull requests to identify OWASP Top 10 vulnerabilities, auth flaws, and logic bugs early in development. • Scope and manage external penetration tests and bug bounty programs; validate findings and partner directly with engineering squads to write and verify technical remediation fixes. • Secure APIs and backend endpoints interfacing with connected medical devices and client applications. Compliance Automation & Audit Readiness (SOC 2 / HIPAA) • Serve as the primary technical interface for SOC 2 Type II and HIPAA audits, partnering with DevOps to maintain technical security controls and automated evidence collection. • Leverage continuous compliance and posture management platforms (e.g., Vanta) to ensure production cloud infrastructure continuously meets audit baselines without manual overhead. Engineering Incident Response • Investigate security alerts generated from AWS GuardDuty, Inspector, and production infrastructu