DevSecOps Engineer at Virta Health

Role overview

Virta Health is pioneering a new standard of care for people to reclaim their lives. We are in the midst of a public health crisis: obesity rates are at an all-time high and over half of US adults have type 2 diabetes or prediabetes, and despite billions spent on new treatments, outcomes are largely worse. Virta reverses these diseases and delivers life-changing results by pairing individualized nutrition with ongoing care from a clinical support team. We have raised over $350 million from top-tier investors, and partner with the largest health plans, employers, and government organizations to help their employees and members restore their health and take back their lives.

As we rapidly scale our impact, we're seeking a passionate DevSecOps engineer to help build and mature our application security program. Working closely with our security lead, you'll implement best practices and help embed security principles across the org. If you thrive on building secure systems, automation, fostering a security-conscious culture, and making a tangible difference in protecting sensitive health information, this role is for you.

Responsibilities

• As a DevSecOps Engineer, you will help secure Virta's applications and platform, directly contributing to the trust our members and partners place in us. You'll collaborate across teams to ensure security is a seamless part of our development lifecycle.
• Improve Security Design: Help assess our current security controls within GCP and Kubernetes, identify areas for improvement, and contribute to the maturation of our security posture from good to great.
• Champion Secure Development: Partner closely with Engineering, Product, and Platform teams to integrate security best practices early and often ("shift-left") into the software development lifecycle.
• Build and Automate: Design, implement, and manage security tooling and automation to streamline vulnerability detection, remediation, and compliance verification. Replace manual processes with efficient, automated solutions.
• Refine Access Control: Evolve our identity and access management (IAM) strategy, ensuring least-privilege access and robust auditing capabilities across our systems.
• Strengthen Network Security: Continuously improve our network security architecture, policies, and controls within our cloud environment.
• Develop Clear Standards: Establish, document, and communicate practical security policies, standards, and guidelines for engineering teams.
• Support Security Initiatives: Drive vulnerability management efforts and enhance our incident response preparedness, ensuring we are ready to handle potential threats effectively.
• Cultivate Security Awareness: Act as a security evangelist, promoting security awareness and best practices throughout the engineering organization.
• Joining a new company and stepping into a foundational role takes time. Here’s what you can expect as you get started and begin making your mark:
• Immerse Yourself: Your initial focus will be on understanding Virta's culture, our mission, our engineering workflows, and the nuances of our cloud platform (GCP/Kubernetes). You'll connect with key engineers and stakeholders across different teams.
• Learn the Landscape: You'll dive into our existing systems, CI/CD pipelines, and current security tooling and configurations to get a clear picture of where we stand today.
• Assess & Identify Opportunities: Leveraging your expertise, you'll begin evaluating our current security posture, including critical areas like our IAM implementation (RBAC), data security practices, network controls, and existing security policies. You'll help identify high-impact areas for improvement.
• Start Building: You'll quickly move into hands-on work, likely starting with foundational projects such as refining IAM roles, enhancing specific security configurations, or beginning to develop key security automation or documentation.
• Understanding and practical experience in securing cloud-native applications and infrastructure, particularly in Kubernetes environments. GCP experience is strongly preferred.
• Strong grasp of networking concepts, identity management (IAM), encryption, and common web application vulnerabilities (e.g., OWASP Top 10).

Qualifications

• Strong grasp of networking concepts, identity management (IAM), encryption, and common web application vulnerabilities (e.g., OWASP Top 10).
• Strong communication skills with the ability to clearly articulate complex security concepts to diverse audiences and influence technical direction across teams.
• Proficiency in Infrastructure as Code (IaC) tools, specifically Terraform.
• Virta’s company values drive our culture, so you’ll do well if:
• You put people first and take care of yourself, your peers, and our patients equally
• You have a strong sense of ownership and take initiative while empowering others to do the same
• You prioritize positive impact over busy work
• You appreciate transparency and promote trust and empowerment through open access of information
• You are evidence-based and prioritize data and science over seniority or dogma
• You take risks and rapidly iterate
• Is this role not quite what you're looking for? Join our Talent Community and follow us on Linkedin to stay connected!

Technology in this role

• Python: • Development experience with Go and/or .
• AWS: Virta uses Ashby as its applicant tracking system, which incorporates AI-powered tools (provided by OpenAI, AWS, and Google Gemini) in certain aspects of the recruiting process, including application review, candidate screening, and interview note .
• GCP: Improve Security Design: Help assess our current security controls within GCP and Kubernetes, identify areas for improvement, and contribute to the maturation of our security posture from good to .
• Kubernetes: Improve Security Design: Help assess our current security controls within GCP and Kubernetes, identify areas for improvement, and contribute to the maturation of our security posture from good to .
• Go: • Development experience with Go and/or .
• Terraform: Proficiency in Infrastructure as Code (IaC) tools, specifically .
• CI/CD: Learn the Landscape: You'll dive into our existing systems, CI/CD pipelines, and current security tooling and configurations to get a clear picture of where we stand .
• CAN: Here’s what you can expect as you get started and begin making your mark: Immerse Yourself: Your initial focus will be on understanding Virta's culture, our mission, our engineering workflows, and the nuances of our cloud platform .
• OWASP: Strong grasp of networking concepts, identity management (IAM), encryption, and common web application vulnerabilities (e.g., OWASP Top .
• SAST: • Hands-on experience in application security, including secure coding practices, vulnerability management, and security testing (SAST, DAST, .
• DAST: • Hands-on experience in application security, including secure coding practices, vulnerability management, and security testing (SAST, DAST, .

About Virta Health

Virta Health combines clinical care, nutrition support and technology to address metabolic health conditions, including type 2 diabetes and obesity. The company describes a personalized care model supported by clinicians, member tools and evidence from clinical research and real-world outcomes.

That mission creates technology needs across patient and clinician experiences, care operations, data, analytics, security and health-related workflows. Work in a healthcare setting can involve sensitive information and careful operational requirements, but the particular role’s posting is the authority on its scope and compliance responsibilities. Candidates should review the listed team, users, technologies and work arrangement rather than assume every role is directly clinical.

Browse job categories

Related jobs

• Principal Software Engineer — GRADION
• Senior Security Engineer, Offensive Security at Docker — Docker
• Senior Customer Onboarding Engineer at Horizon3 — Horizon3
• Senior Backend Engineer, Growth and MSSP at Horizon3 — Horizon3
• Senior Backend Integrations Engineer at Horizon3 — Horizon3
• Cloud Engineer — Techcombank