• Design, build, and implement secure solutions and automation to embed security testing and controls within the SDLC, serving as a hands-on expert in secure development practices. • Partner with engineering teams to move from reactive security fixes to proactive, embedded security in their development workflows. • Collaborate with product and engineering teams to perform security reviews, threat modeling, and design reviews for new features and architectural changes. • Actively develop and contribute code to internal security tools, security testing frameworks (e.g., SAST, DAST, SCA), and defensive libraries to proactively identify and address vulnerabilities. • Lead incident response for application-related security events, focusing on root cause analysis and implementing preventative controls. • Integrate security capabilities directly into CI/CD pipelines and engineering workflows to automate vulnerability detection and remediation. • Design and implement security architecture for web applications, APIs, and microservices, ensuring security by design. • Develop secure coding standards, security patterns, and reusable components for application development and deployment. • Conduct threat modeling across the application portfolio to identify and prioritize risks. • Establish and maintain security controls for development, staging, and production environments. • Translate application security strategies into actionable development plans and prototypes. • Evaluate third-party components, libraries, and SaaS providers for security, compliance, and data protection. • Assess emerging application security tools and technologies. • Review cloud-based services and configurations for compliance and security posture. • Partner with legal and compliance teams to ensure application security initiatives meet regulatory (e.g., HIPAA, HITECH) and contractual requirements. • Implement and monitor controls for data privacy, integrity, and access management within the application layer. • Develop metrics and reporting for the application security posture across engineering teams. • Liaison with customers and auditors on SimplePractice’s approach to application security and compliance. • Leverage automation to operationalize security and compliance workflows, continuously monitoring and improving our security posture.