Application Security Engineer

Passionate about precision medicine and advancing the healthcare industry? Recent advancements in underlying technology have finally made it possible for AI to impact clinical care in a meaningful way. Tempus' proprietary platform connects an entire ecosystem of real-world evidence to deliver real-time, actionable insights to physicians, providing critical information about the right treatments for the right patients, at the right time. Passionate about precision medicine and advancing the healthcare industry? Recent advancements in underlying technology have finally made it possible for AI to impact clinical care in a meaningful way. Tempus' proprietary platform connects an entire ecosystem of real-world evidence to deliver real-time, actionable insights to physicians, providing critical information about the right treatments for the right patients, at the right time. About the role: As an Application Security Engineer, you will secure how Tempus builds software, from design through release. You will partner with product and engineering teams to build security into the software development lifecycle (SDLC), and you will assess our applications and APIs the way an attacker would, through security assessments and penetration tests. The applications you secure handle sensitive clinical and genomic data and increasingly include AI-powered capabilities, so securing AI and LLM-enabled systems is a core part of the role. You will own well-defined application security problems within your team's scope, with guidance from your lead. What you'll do Embed security into the SDLC through threat modeling, design reviews, security requirements, and security-focused code reviews with product and development teams. Plan and conduct application security assessments and penetration tests of web applications, APIs, and cloud-hosted services, and document findings with clear risk ratings and practical remediation guidance. Threat model and assess AI and LLM-enabled features (agents, RAG pipelines, tool and MCP integrations), including adversarial prompt testing and validation of guardrails, permissions, and data access controls. Select, integrate, and tune SAST, DAST, software composition analysis, and secrets scanning in CI/CD pipelines. Build automation, secure-by-default patterns, and guardrails that prevent whole classes of vulnerabilities. Use AI-assisted tooling to scale code review, triage, and remediation, applying human judgment to validate the results. Reproduce, triage, and prioritize application security vulnerabilities, and work with developers through to remediation. Communicate the nature, severity, and business risk of security issues to development teams and leadership. Design, implement, and document application security controls, standards, and secure coding guidance. Run and support the vulnerability disclosure program. Coach developers on secure design and coding through consulting, training, and everyday collaboration. What you'll bring 3-5 years of experience in application security, penetration testing, or software engineering with a security focus. Hands-on experience testing web applications, APIs, and cloud-hosted services, using proxying and penetration testing tools (e.g. Burp Suite), and strong command of common security flaws and mitigations (e.g. OWASP Top 10). Experience performing security design reviews at the architecture level Working experience securing AI and LLM-enabled applications: how they are designed and how they fail, including prompt injection, data leakage, excessive agency, and insecure output handling (e.g. OWASP Top 10 for LLM Applications). Practical experience with at least one threat modeling method (e.g. STRIDE, PASTA, attack trees). Experience with SAST, DAST, and SCA tools and integrating them into CI/CD pipelines. Proficiency in Python, Go, or JavaScript for security tooling and automation, and the ability to read and review code. Solid understanding of network and web protocols (TCP/IP, HTTP/S), authentication and authorization (e.g. OAuth/OIDC), and cryptography fundamentals. Able to work well with software development teams and Product Managers. Excellent written and verbal communication, with the ability to explain complex topics clearly and concisely. Bonus points for: Hands-on AI red teaming or security testing of agentic or RAG systems; familiarity with MITRE ATLAS or the NIST AI Risk Management Framework Experience with Docker, Kubernetes, GCP or AWS, and infrastructure-as-code scanning Bug bounty or vulnerability disclosure program experience Experience with HIPAA and healthcare data protection An interest in working in biotech, genomics, and precision medicine Certifications such as GWAPT, OSCP, CSSLP, CISSP, or ISC2 CC (Certified in Cybersecurity) CHI: $85,000-$130,000 The expected salary range may vary for other locations. Actual salary may vary based on qualifications and experience. Tempus offers a full range of benefits, which may include incentive compensation, restricted stock units, medical and other benefits depending on the position. We are an equal opportunity employer. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. Ambry Genetics Corporation is a CAP-accredited and CLIA-licensed molecular genetics laboratory based in Aliso Viejo, California. We are a genetics-based healthcare company that is dedicated to open scientific exchange so we can work together to understand and treat all human disease faster. At Ambry, everyone is welcome. A career at Ambry Genetics is a chance to be part of a dynamic company that aims to improve health by understanding the relationships between genetics and human disease. We earned our reputation as industry leaders by responsibly introducing cutting-edge genetic testing solutions and continually sharing what we learn with the global scientific community. At Ambry you will be learning, challenging yourself, and having fun while collaborating with teammates through the open exchange of ideas. Our outstanding benefits program includes medical, dental, vision, FSA, paid sick leave and generous paid time off (PTO) program. The Company reserves the right to make changes to the 401k plan from time to time. You can learn more about the benefits here. Ambry Genetics is an Equal Opportunity Employer (EOE) and we maintain a drug-free work environment. The Company believes in second chance employment. Qualified applicants with arrest or conviction history will be considered regardless of their arrest or conviction history, consistent with local laws such as Los Angeles County Fair Chance Ordinance and the California Fair Chance Act. You do not need to disclose your criminal history or participate in a background check until a conditional job offer is made to you. After making a conditional offer and running a background check, if the Company is concerned about conviction that is directly related to the job, you will be given the chance to explain the circumstances surrounding the conviction, provide mitigating evidence, or challenge the accuracy of the background report. For the purpose of the above job description, “Essential Functions” are “Material Job Duties”. Our salary ranges are determined by role, level, and location. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position across all US locations. Within the range, individual pay is determined by work location and additional factors, including job-related skills, experience, and relevant education or training. All qualified applicants will receive consideration for employment without regard to race (and traits historically associated with race, including, but not limited to hair texture and protective hairstyles such as braids, locks, and twists), color, creed, religion, sex, sexual orientation, gender identity, gender expression (including transgender status), national origin, ancestry, age, marital status or protected veteran status and will not be discriminated against on the basis of disability, protected medical condition as defined by applicable state or local law, genetic information, or any other characteristic protected by applicable federal, state, or local laws and ordinances. If you have a disability or special need that requires accommodation, please contact us at careers@ambrygen.com Ambry does not accept unsolicited resumes from individual recruiters, third party recruiting agencies, outside recruiters or firms without an executed contract in place. We are not responsible for any fees related to resumes that are unsolicited or are received by Ambry. Such resumes will be deemed the sole property of Ambry and will be processed accordingly. To review Ambry’s Privacy Notice, click here: Ambry’s Privacy Notice To review the California privacy notice, click here: California Privacy Notice | Ambry Genetics