Senior Application Security Engineer
At Commure, we're building the AI Operating System for healthcare, the foundation that defines how care is delivered, documented, and financed. Our platform spans the full care journey: Ambient AI and Dictation eliminating documentation burden at the point of care, intelligent Agents automating patient and revenue workflows, and autonomous RCM processing billions in claims, all on a single AI-native platform integrated with 60+ EHRs. Healthcare carries a $1 trillion administrative burden and we're at the center of transforming it. Today, 500,000+ clinicians across 500+ healthcare organizations nationwide trust Commure to handle $25B+ in annual claims and support over 200 million patient interactions. Our latest $70M raise at a $7B valuation reflects the confidence the market has placed in this mission.
About the role
Security patterns that worked 20 years ago don't hold up anymore, especially as AI changes how fast engineering teams ship code. We're looking for an Application Security Engineer who combines real engineering depth with security fundamentals — someone who gets into the code, spots systemic patterns, and builds the tooling and fixes that address them at scale, rather than flagging issues for someone else to resolve.
This isn't an audit-from-a-distance role. You'll work directly with engineering, with no interim layer needed, and you'll be equally comfortable owning a project end-to-end as you are looping in support when it counts.
Full Time position requires working 3 days a week in our Mountain View office (Hybrid).
Responsibilities
- Identify systemic security gaps in our codebase and engineering workflows, and drive durable fixes with engineering, not just one-off patches
- Build security tooling and automation, including SAST/SCA integration and custom checks, that catches issues earlier rather than after they ship
- Conduct code reviews and security design reviews for major product initiatives, including agentic AI systems and data pipelines
- Drive threat modeling for new features and translate requirements into guidance engineers actually use
- Think through what AI-accelerated development means for how we find, prioritize, and fix risk, and use AI tooling where it genuinely helps
- Present our security posture to enterprise customers, including healthcare and regulated-data conversations
Requirements
- 5+ years of hands-on application security or software engineering experience, not mainly audit or compliance work
- Genuine engineering depth: you can read and reason about code well enough to find real bugs and root causes
- Strong AppSec fundamentals: threat modeling, secure code review, and OWASP-aligned vulnerability knowledge
- Comfort operating independently with good judgment in a fast-moving environment
- Clear communication that earns trust with engineers
Skills
- Experience securing agentic AI or LLM-powered systems
- Experience building SAST pipelines or custom static analysis rules
- Healthcare or other regulated-industry security experience (PHI, HIPAA)
- Offensive security background (bug bounty, CTF, pentesting)
- Direct enterprise customer experience
Pay
Compensation Range: $160K - $190K