Remote Security Software Engineer Jobs
Remote security software engineer jobs are concentrated across cybersecurity, cloud infrastructure, fintech, and defense technology, with openings at remote-first software companies, distributed enterprise teams, and security-focused startups. Employers hiring remotely right now include Pinterest, Celink, and Upstart, with roles from junior application security engineers to principal security architects. Find a role that fits below and apply directly.
Find JobsOverview
Showing 5 of 25+ Remote Security Software Engineer jobs
INTRODUCTION
The Staff Cloud Security Engineer is a critical, hands-on technical role responsible for engineering, implementing, and automating robust security controls within our cloud environments (AWS primarily, with GCP considerations). This role is pivotal in maturing our cloud security posture, securing Included Health's product infrastructure, and directly contributing to the prevention of unauthorized PHI exfiltration. You will help design and develop advanced security solutions, often through code (Python, Go, etc.) and automation (Terraform), to address critical challenges in access control, development environment security, and infrastructure hardening. This role requires deep technical expertise in cloud security, strong software development skills for building security tools and automation, and a proactive approach to risk mitigation. You will be a key technical peer to our infrastructure software and engineering teams, driving a culture of security by design and helping to implement solutions that reduce HIPAA incidents. This is a remote role reporting to the Chief Information Security Officer.
Responsibilities:
- Design, develop, and implement a comprehensive authorization framework for cloud resources, addressing user roles, resource-specific restrictions, task-based access, and granular engineering access.
- Lead the technical implementation of Just-In-Time (JIT) access control systems for production environments (systems, secrets, data) to minimize standing privileges for engineering and platform teams.
- Collaborate with engineering to integrate data classification (e.g., safe-harbor annotations) with access control mechanisms, ensuring that data sensitivity directly informs access decisions.
- Develop and maintain security automation scripts, tools, and services in Python or Go to streamline security operations, vulnerability management, compliance checks, and incident response.
- Write clean, maintainable, and testable code (primarily Python and Go; familiarity with Ruby is a plus) for security automation, building custom security integrations, and developing security-focused tools.
- Implement and champion Infrastructure as Code (IaC) principles, specifically using Terraform, for programmatic definition, enforcement, and auditing of security configurations.
- Contribute to the design and implementation of centralized security controls, such as an engineering-owned Web Application Firewall (WAF), to manage rate limiting, IP blocking, input validation, and request filtering.
- Partner with engineering teams to establish and implement secure practices for managing the development toolchain (code generation utilities, linters, browser extensions, CLI tools, IDE plugins) to mitigate supply chain risks.
- Design and help implement a secure, "blessed" mechanism for webhook testing in local development environments, blocking unauthorized tunneling tools.
- Define, implement, and enforce container security hardening standards (e.g., least privilege, no unnecessary utilities, limited internet access) in collaboration with engineering teams.
- Drive the remediation of legacy cloud environments, particularly in GCP, by inventorying, assessing, and improving security controls.
- Design and implement solutions for granular data access control in cloud environments, particularly addressing compliance requirements for handling sensitive data.
- Collaborate closely with infrastructure software, engineering, DevOps, and product teams to co-design and integrate robust, automated security controls into systems, architectures, and CI/CD pipelines.
- Act as a subject matter expert on cloud security (AWS, GCP), providing guidance, code reviews (Python, Go), and technical expertise on secure cloud adoption, secure software development, and access control best practices.
- Support organizational change management efforts related to new security controls and practices by providing technical rationale and assisting in the development of new workflows.
- Conduct security assessments, threat modeling, and contribute to incident response, developing automation for prevention and faster response.
- Develop and maintain comprehensive documentation for security architectures, controls, automation scripts, and incident response playbooks.
QUALIFICATIONS
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- 5+ years of experience in cloud security, with a strong emphasis on designing, developing (primarily in Python and Go), and implementing security solutions in AWS.
- Proven hands-on software development experience, particularly in Python and Go, for security automation, building security tools, and infrastructure management.
- Demonstrable experience designing and implementing robust authorization and access control frameworks (e.g., RBAC, ABAC, policy-as-code) and Just-In-Time (JIT) access solutions.
- Experience with Infrastructure as Code (IaC) with deep proficiency in writing and maintaining Terraform modules for security.
- Experience with containerization (Docker, Kubernetes/EKS), including hands-on experience hardening containerized environments.
- Experience with SDLC security, CI/CD pipeline security integration, and secure software development practices.
- Experience with security logging, monitoring, alerting tools (e.g., SIEM, AWS CloudTrail, CloudWatch, GuardDuty), and scripting against their APIs (Python, Go).
- Experience with cloud security frameworks (especially HIPAA), regulations, and standards.
Pay:
The United States new hire base salary target ranges for this full-time position are:
Zone A: $174,320 - $246,230 + equity + benefits
Zone B: $191,752 - $270,853 + equity + benefits
Zone C: $209,184 - $295,476 + equity + benefits
Zone D: $226,616 - $320,099 + equity + benefits
This range reflects the minimum and maximum target for new hire salaries for candidates based on their respective Zone. Below is additional information on Included Health's commitment to maintaining transparent and equitable compensation practices across our distinct geographic zones.
Starting base salary for you will depend on several job-related factors, unique to each candidate, which may include education; training; skills; years and depth of experience; certifications and licensure; our needs; internal peer equity; organizational considerations; and understanding of geographic and market data. Compensation structures and ranges are tailored to each zone's unique market conditions to ensure that all employees receive fair and great compensation package based on their roles and locations. Your Recruiter can share your geographic zone upon inquiry.
Benefits & Perks:
In addition to receiving a great compensation package, the compensation package may include, depending on the role, the following and more:
- Remote-first culture
- 401(k) savings plan through Fidelity
- Comprehensive medical, vision, and dental coverage through multiple medical plan options (including disability insurance)
- Paid Time Off ("PTO") and Discretionary Time Off ("DTO")
- 12 weeks of 100% Paid Parental leave
- Family Building & Compassionate Leave: Fertility coverage, $25,000 for surrogacy/adoption, and paid leave for failed treatments, adoption or pregnancies.
- Work-From-Home reimbursement to support team collaboration home office work
Your recruiter will share more about the salary range and benefits package for your role during the hiring process.
About Included Health
Included Health is a new kind of healthcare company, delivering integrated virtual care and navigation. We’re on a mission to raise the standard of healthcare for everyone. We break down barriers to provide high-quality care for every person in every community — no matter where they are in their health journey or what type of care they need, from acute to chronic, behavioral to physical. We offer our members care guidance, advocacy, and access to personalized virtual and in-person care for everyday and urgent care, primary care, behavioral health, and specialty care. It’s all included. Learn more at includedhealth.com.
Included Health is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics or any other basis forbidden under federal, state, or local law. Included Health considers all qualified applicants with arrest or conviction records in accordance with the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance, and California law.
Included Health uses AI-assisted tools at select stages of the hiring process to enhance efficiency, consistency, and communication. AI does not make hiring decisions—final decisions are made exclusively by our recruiting and hiring teams.
INTRODUCTION
The Staff Cloud Security Engineer is a critical, hands-on technical role responsible for engineering, implementing, and automating robust security controls within our cloud environments (AWS primarily, with GCP considerations). This role is pivotal in maturing our cloud security posture, securing Included Health's product infrastructure, and directly contributing to the prevention of unauthorized PHI exfiltration. You will help design and develop advanced security solutions, often through code (Python, Go, etc.) and automation (Terraform), to address critical challenges in access control, development environment security, and infrastructure hardening. This role requires deep technical expertise in cloud security, strong software development skills for building security tools and automation, and a proactive approach to risk mitigation. You will be a key technical peer to our infrastructure software and engineering teams, driving a culture of security by design and helping to implement solutions that reduce HIPAA incidents. This is a remote role reporting to the Chief Information Security Officer.
Responsibilities:
- Design, develop, and implement a comprehensive authorization framework for cloud resources, addressing user roles, resource-specific restrictions, task-based access, and granular engineering access.
- Lead the technical implementation of Just-In-Time (JIT) access control systems for production environments (systems, secrets, data) to minimize standing privileges for engineering and platform teams.
- Collaborate with engineering to integrate data classification (e.g., safe-harbor annotations) with access control mechanisms, ensuring that data sensitivity directly informs access decisions.
- Develop and maintain security automation scripts, tools, and services in Python or Go to streamline security operations, vulnerability management, compliance checks, and incident response.
- Write clean, maintainable, and testable code (primarily Python and Go; familiarity with Ruby is a plus) for security automation, building custom security integrations, and developing security-focused tools.
- Implement and champion Infrastructure as Code (IaC) principles, specifically using Terraform, for programmatic definition, enforcement, and auditing of security configurations.
- Contribute to the design and implementation of centralized security controls, such as an engineering-owned Web Application Firewall (WAF), to manage rate limiting, IP blocking, input validation, and request filtering.
- Partner with engineering teams to establish and implement secure practices for managing the development toolchain (code generation utilities, linters, browser extensions, CLI tools, IDE plugins) to mitigate supply chain risks.
- Design and help implement a secure, "blessed" mechanism for webhook testing in local development environments, blocking unauthorized tunneling tools.
- Define, implement, and enforce container security hardening standards (e.g., least privilege, no unnecessary utilities, limited internet access) in collaboration with engineering teams.
- Drive the remediation of legacy cloud environments, particularly in GCP, by inventorying, assessing, and improving security controls.
- Design and implement solutions for granular data access control in cloud environments, particularly addressing compliance requirements for handling sensitive data.
- Collaborate closely with infrastructure software, engineering, DevOps, and product teams to co-design and integrate robust, automated security controls into systems, architectures, and CI/CD pipelines.
- Act as a subject matter expert on cloud security (AWS, GCP), providing guidance, code reviews (Python, Go), and technical expertise on secure cloud adoption, secure software development, and access control best practices.
- Support organizational change management efforts related to new security controls and practices by providing technical rationale and assisting in the development of new workflows.
- Conduct security assessments, threat modeling, and contribute to incident response, developing automation for prevention and faster response.
- Develop and maintain comprehensive documentation for security architectures, controls, automation scripts, and incident response playbooks.
QUALIFICATIONS
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- 5+ years of experience in cloud security, with a strong emphasis on designing, developing (primarily in Python and Go), and implementing security solutions in AWS.
- Proven hands-on software development experience, particularly in Python and Go, for security automation, building security tools, and infrastructure management.
- Demonstrable experience designing and implementing robust authorization and access control frameworks (e.g., RBAC, ABAC, policy-as-code) and Just-In-Time (JIT) access solutions.
- Experience with Infrastructure as Code (IaC) with deep proficiency in writing and maintaining Terraform modules for security.
- Experience with containerization (Docker, Kubernetes/EKS), including hands-on experience hardening containerized environments.
- Experience with SDLC security, CI/CD pipeline security integration, and secure software development practices.
- Experience with security logging, monitoring, alerting tools (e.g., SIEM, AWS CloudTrail, CloudWatch, GuardDuty), and scripting against their APIs (Python, Go).
- Experience with cloud security frameworks (especially HIPAA), regulations, and standards.
Pay:
The United States new hire base salary target ranges for this full-time position are:
Zone A: $174,320 - $246,230 + equity + benefits
Zone B: $191,752 - $270,853 + equity + benefits
Zone C: $209,184 - $295,476 + equity + benefits
Zone D: $226,616 - $320,099 + equity + benefits
This range reflects the minimum and maximum target for new hire salaries for candidates based on their respective Zone. Below is additional information on Included Health's commitment to maintaining transparent and equitable compensation practices across our distinct geographic zones.
Starting base salary for you will depend on several job-related factors, unique to each candidate, which may include education; training; skills; years and depth of experience; certifications and licensure; our needs; internal peer equity; organizational considerations; and understanding of geographic and market data. Compensation structures and ranges are tailored to each zone's unique market conditions to ensure that all employees receive fair and great compensation package based on their roles and locations. Your Recruiter can share your geographic zone upon inquiry.
Benefits & Perks:
In addition to receiving a great compensation package, the compensation package may include, depending on the role, the following and more:
- Remote-first culture
- 401(k) savings plan through Fidelity
- Comprehensive medical, vision, and dental coverage through multiple medical plan options (including disability insurance)
- Paid Time Off ("PTO") and Discretionary Time Off ("DTO")
- 12 weeks of 100% Paid Parental leave
- Family Building & Compassionate Leave: Fertility coverage, $25,000 for surrogacy/adoption, and paid leave for failed treatments, adoption or pregnancies.
- Work-From-Home reimbursement to support team collaboration home office work
Your recruiter will share more about the salary range and benefits package for your role during the hiring process.
About Included Health
Included Health is a new kind of healthcare company, delivering integrated virtual care and navigation. We’re on a mission to raise the standard of healthcare for everyone. We break down barriers to provide high-quality care for every person in every community — no matter where they are in their health journey or what type of care they need, from acute to chronic, behavioral to physical. We offer our members care guidance, advocacy, and access to personalized virtual and in-person care for everyday and urgent care, primary care, behavioral health, and specialty care. It’s all included. Learn more at includedhealth.com.
Included Health is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics or any other basis forbidden under federal, state, or local law. Included Health considers all qualified applicants with arrest or conviction records in accordance with the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance, and California law.
Included Health uses AI-assisted tools at select stages of the hiring process to enhance efficiency, consistency, and communication. AI does not make hiring decisions—final decisions are made exclusively by our recruiting and hiring teams.
See All 25 Remote Security Software Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsRemote Security Software Engineer Job Market
Who's Hiring
- Pinterest8
- Celink2
- Upstart2
- Palo Alto Networks2
- OpenAI1
Top Industries Hiring
- Technology & Software17
- Banking & Financial Services6
- Agriculture & Farming1
- Artificial Intelligence1
What Employers Look For
The qualifications that appear most often in remote security software engineer jobs.
- Proficiency in at least one systems or low-level language such as C, C++, or Rust
- Experience with secure software development lifecycle practices and threat modeling
- Familiarity with OWASP Top 10 and common vulnerability classes across web and API layers
- Knowledge of cryptographic protocols, PKI, and key management concepts
- Active or ability to obtain a federal security clearance for government-adjacent roles
- Bachelor's degree in computer science, cybersecurity, or a closely related engineering field
Tips for Your Remote Security Software Engineer Job Search
Apply early to remote roles that fit
Migrate Mate lists remote security software engineer openings from across the U.S. in one place, so you can find roles that match your skills and apply directly without sifting through location-filtered results or mixed job boards.
Build a portfolio of security work
Remote employers can't observe you in an office, so documented work carries more weight. Publish CTF writeups, contribute to open-source security tools, or maintain a home lab writeup that shows your threat modeling and secure development process in action.
Demonstrate async communication in your application
Remote security software engineer teams run on written communication. Write a cover note that explains your security approach clearly and concisely, because how you write in the application is how hiring managers assume you'll communicate during incidents and code reviews.
Target distributed teams with security-embedded cultures
Remote-first companies that already have security integrated into their engineering workflow hire more quickly because there's no friction around remote security practices. Look for job descriptions that mention threat modeling in sprints, security champions programs, or async security review processes.
Prepare for remote-format technical security interviews
Remote security interviews typically use shared coding environments, screen-share vulnerability walkthroughs, and async take-home challenges. Practice explaining your reasoning out loud while working through secure code review exercises, since interviewers can't see your thought process any other way.
Remote Security Software Engineer Jobs: Frequently Asked Questions
How do I get a remote security software engineer job?
Target companies that operate fully distributed teams or have established remote security practices, such as cloud-native SaaS firms, fintech platforms, and cybersecurity vendors. Remote employers screen heavily for self-direction and written communication alongside technical skills like threat modeling, secure code review, and familiarity with cloud security tooling. Candidates who can demonstrate async collaboration, document security decisions clearly, and work independently across time zones consistently stand out.
Which companies hire remote security software engineers?
Remote security software engineer roles are posted by Pinterest, Celink, and Upstart and others right now, based on current remote listings on Migrate Mate as of June 2026. The hiring mix tends to be remote-first software companies, distributed security teams at cloud and fintech firms, and cybersecurity vendors operating across multiple time zones.
Can you get a remote security software engineer job with no experience?
Yes, but remote entry-level security software engineer roles are harder to land because employers expect you to work independently from day one without in-person mentorship. Smaller remote-first companies and security-focused startups are the most accessible. A portfolio of hands-on work, such as CTF writeups, open-source security tooling contributions, or documented home lab projects, can substitute for professional experience and demonstrate you're ready to contribute without close supervision.
Do you need a degree for remote security software engineer jobs?
Not always. Many remote employers prioritize demonstrated skills over a formal degree for security software engineers, particularly certifications like OSCP, CISSP, or CEH alongside a strong portfolio of applied security work. Remote hiring processes that rely on technical screening stages tend to weight what you can actually do, so candidates who show real vulnerability research, secure development experience, or published tooling can compete without a four-year degree.
Which industries hire the most remote security software engineers?
Most remote security software engineer openings sit in Technology & Software, Banking & Financial Services, and Agriculture & Farming, per current remote listings on Migrate Mate as of June 2026. These sectors hire security software engineers remotely because their distributed engineering teams need embedded security expertise across geographies rather than centralized, on-site coverage.
See All 25 Remote Security Software Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs