DevSecOps Engineer

About the Company Antidote Health is a tech- driven health insurance company on a mission to make healthcare easy, accessible, and more affordable. We’re rethinking how healthcare works—using technology to remove the friction, complexity, and delays that define the traditional system. Instead of navigating paperwork, long waits, and disconnected experiences, we’re building a simpler, more connected way for people to get care. Our platform combines health coverage, virtual care, and a modern member experience into one seamless system designed to help people actually use their benefits. We offer Affordable Care Act (ACA) health plans in Arizona and Ohio, and we’re growing quickly. We’re building a company focused on solving real problems—with real impact on people’s lives. Position Overview As a DevSecOps Engineer at Antidote Health, you'll build the security foundations that let us deliver virtual care at scale without compromising patient trust. Every system we run touches protected health information, which means security isn't a checkbox at the end of a release — it has to be designed in from the first commit. As we grow, we're looking for a motivated engineer to help us build security tooling and automation that protects patients while keeping our clinical and product teams shipping fast. This is an opportunity to take real ownership of how a regulated healthcare platform is designed, deployed, and defended. Key Responsibilities Design, implement, and maintain robust security practices across our CI/CD pipelines, ensuring security is built-in from the start. Collaborate with engineering teams to integrate security measures into application development and cloud infrastructure, supporting a DevSecOps culture. Work in a GCP cloud environment to enhance security across various platforms, ensuring compliance with best practices and regulatory requirements. Develop and automate security tools and processes for continuous monitoring, vulnerability scanning, incident response, and risk management. Implement infrastructure-as-code (IaC) practices to automate provisioning, security, and monitoring tasks across our infrastructure. Stay up to date with emerging security threats, vulnerabilities, and compliance standards to keep our environments secure. Provide guidance and mentorship to development teams on security best practices and assist in threat modelling. Collaborate with cross-functional teams to drive the adoption of secure coding practices and create a strong security culture across the organization. Help improve our cloud security posture, including identity and access management, network security, and incident detection. Qualifications Required: 3+ years' experience in a DevSecOps or similar role, with a strong background in security and operations Hands-on experience with GCP clouud platforms (or equivalent) and familiarity with IaC frameworks like Terraform/Helm and such. Strong experience with containerized deployments and orchestration tools like Kubernetes and Helm Strong knowledge of security frameworks and methodologies (NIST, OWASP, CIS) and understanding of security best practices in a cloud-native environment. Experience with CI/CD pipelines and integrating security into these workflows using tools like GitHub Actions Proficiency in scripting and automation using languages like Python, Bash, Node Preferred: Prior experience in healthcare, health tech, or another regulated industry (fintech, insurance). Experience supporting a HIPAA, SOC 2, or HITRUST audit as a technical contributor. Familiarity with healthcare data standards and integration patterns (HL7, FHIR) from a security perspective. Experience with compliance automation or evidence-collection platforms. Competencies Strong problem-solving skills and the ability to work in a fast-paced, high-growth startup environment Excellent communication skills, with the ability to explain complex security topics to technical and non-technical stakeholders Equal Opportunity Statement Antidote Health is an equal opportunity employer and makes employment decisions without regard to race, color, religion, sex, age, disability, marital status, pregnancy, sexual orientation, gender identity, national origin, military reserve duty, or any other protected status under applicable law.