Security Engineer Intern
Security Engineer · Intern · Internship
Opens Notable's application page
Role
What you'll do.
As a Security Engineer Intern at Notable, you'll design and automate security controls protecting a healthcare AI platform serving millions of patients. You'll collaborate with security and infrastructure teams to build infrastructure-as-code policy checks, detection playbooks, and secure-by-default developer workflows while contributing to cloud security posture improvements in a regulated healthcare environment.
Responsibilities
- Build and Automate Security Controls: Design, develop, and deploy automated security controls and guardrails in collaboration with Security and Infrastructure teams. This includes implementing Infrastructure-as-Code (IaC) policy checks, establishing least-privilege baseline configurations, and integrating automated secrets detection into CI/CD pipelines to enforce security standards across the development lifecycle.
- Create Detection and Response Playbooks: Author detection rules and incident response playbooks for identified security risks affecting the healthcare platform. Validate effectiveness through controlled simulation exercises, document comprehensive runbooks with clear decision trees, and establish measurable metrics for detection accuracy and response times.
- Enhance Secure Development Workflows: Contribute to the implementation of secure-by-default developer practices including pre-commit security hooks, SAST/DAST pipeline integration, and automated dependency scanning. Collaborate on triaging, prioritizing, and tracking security findings through remediation and closure to maintain a healthy security posture.
- Improve Cloud Security Posture: Identify and implement measurable security improvements across cloud infrastructure including misconfiguration detection, logging and telemetry coverage expansion, and resource tagging hygiene. Focus on addressing low-to-medium risk gaps that enhance the overall security foundation of the platform.
- Document Security Operations: Create clear, maintainable documentation and standard operating procedures for all developed security tools and controls. Establish measurable acceptance criteria for handoffs, ensure operational clarity for team adoption, and maintain living documentation that evolves with security improvements.
- Support Security Change Reviews: Participate in security review processes for low-to-medium risk changes to the platform. Track identified mitigations, validate remediation efforts, and provide technical feedback to ensure changes maintain or enhance the security posture of healthcare systems serving millions of patients.
Qualifications
What we look for.
Technical
Programming and Scripting
Hands-on experience with at least one programming language such as Python, Go, or similar for automating security controls and building tooling. Demonstrated ability to read and analyze code for security implications.
Cloud Security Fundamentals
Working knowledge of cloud security concepts and platforms including GCP, AWS, or Azure. Understanding of cloud-native security challenges, misconfiguration risks, and cloud-specific security best practices.
CI/CD and DevSecOps Concepts
Familiarity with CI/CD pipeline security, continuous integration systems, and DevSecOps practices. Understanding of how to integrate security controls into development workflows.
Infrastructure-as-Code Basics
Understanding of IaC principles and experience with tools like Terraform for defining and managing cloud infrastructure. Knowledge of policy-as-code frameworks such as OPA or Conftest for automated compliance.
Container and Kubernetes Basics
Foundational knowledge of containerization, Docker, and Kubernetes security concepts. Understanding of container security risks and best practices for securing containerized workloads.
Identity and Access Management
Understanding of IAM principles, least-privilege access design, role-based access control (RBAC), and authentication/authorization mechanisms in cloud environments.
Education
Computer Science or Related Field
Bachelor's degree in Computer Science, Cybersecurity, Information Security, or related technical discipline, or equivalent demonstrated coursework in security engineering.
Security Engineering Coursework
Completion of courses or projects in security engineering, cloud security, or DevSecOps demonstrating foundational knowledge of security principles and practices.
Experience
Hands-On Security Projects
Demonstrated experience through coursework, personal projects, or internships building security tools, implementing controls, or solving security engineering problems.
Automation and System Design
Experience automating repetitive security tasks, designing measurable improvements to systems, and documenting solutions for operational sustainability.
Problem-Solving and Communication
Proven ability to translate ambiguous security problems into concrete, prioritized plans with clear milestones. Strong verbal and written communication skills for technical and non-technical audiences.
Skills
Required
Python or Go Programming
Proficiency in Python, Go, or similar language for writing security tools, automation scripts, and control logic.
Cloud Platform Knowledge
Working understanding of at least one major cloud platform (GCP, AWS, Azure) including core services, security features, and configuration best practices.
Security Fundamentals
Core understanding of security principles including confidentiality, integrity, availability, authentication, authorization, and encryption.
Scripting and Automation
Ability to write scripts and automation code to reduce manual security tasks and enforce security policies programmatically.
Technical Documentation
Clear written communication ability to document security controls, operational procedures, and technical decisions for team consumption and future reference.
Preferred
Terraform Experience
Nice to haveHands-on experience with Terraform for infrastructure-as-code, including writing and testing Terraform configurations and modules.
Policy-as-Code Tools
Nice to haveFamiliarity with policy-as-code frameworks such as OPA (Open Policy Agent), Conftest, or similar tools for automated compliance and security validation.
GitHub Actions or GitLab CI
Nice to haveExperience with CI/CD platforms and systems, particularly GitHub Actions or GitLab CI for building secure development pipelines.
Log Analysis and SIEM Tools
Nice to haveExperience with log aggregation, analysis platforms, and SIEM tools for security monitoring and event investigation.
Detection Engineering
Nice to haveBasic experience authoring security detection rules, alerts, or signatures for identifying threats in logs or network traffic.
OWASP Top 10 Knowledge
Nice to haveFamiliarity with OWASP Top 10 vulnerabilities and secure software development practices for building resilient applications.
Healthcare Compliance Exposure
Nice to haveFamiliarity with healthcare-specific regulations such as HIPAA, BAA requirements, or regulated environment compliance considerations.
Privacy-Centric Design
Nice to haveUnderstanding of privacy-by-design principles and data protection considerations relevant to healthcare technology platforms.
Tech stack
Languages
Frameworks
Databases
Tools
Other
Compensation
Pay and benefits.
Base·USD 30 – 50
Benefits
Healthcare Impact Mission
Join a company dedicated to transforming healthcare and improving the lives of patients, staff, and clinicians. Contribute to Notable's goal of positively impacting 100 million patients through intelligent automation and security excellence.
Meaningful Work Environment
Be part of a purposeful culture focused on doing the best work of your life while working alongside exceptional teammates committed to creating meaningful change in healthcare technology.
Hands-On Learning Opportunity
Gain practical experience in modern security engineering including cloud security, DevSecOps, infrastructure-as-code, and security automation in a fast-growing healthcare technology company.
Mentorship from Security Experts
Work directly with experienced Security and Infrastructure engineers who will guide your professional development and expose you to industry best practices in security engineering.
Collaborative Team Environment
Partner with Security, Infrastructure, and Product Engineering teams in a culture that values collaboration, clear communication, and shared success in protecting sensitive healthcare data.
Bay Area Office Location
Work in San Mateo, California with in-person collaboration three days per week, providing networking opportunities and access to the Bay Area's thriving technology and healthcare ecosystem.
Process
Interview steps.
- 01
Initial Screening
Phone or video screening with Notable recruiter to discuss your background in security engineering, coursework projects, and interest in healthcare technology and DevSecOps.
- 02
Technical Assessment
Coding or technical problem-solving round focused on scripting (Python/Go), cloud concepts, or security fundamentals. May include questions about infrastructure-as-code or security control design.
- 03
Security Engineering Interview
Technical interview with a Security Engineer or Infrastructure team member covering hands-on security scenarios, detection engineering concepts, and your approach to automating security controls.
- 04
System Design and Collaboration
Discussion around designing security solutions for ambiguous problems, breaking down requirements into milestones, and communicating technical concepts clearly to both technical and non-technical stakeholders.
- 05
Team Fit and Values Alignment
Conversation with team members or hiring manager about Notable's culture, your motivation for healthcare technology, and alignment with the company's mission to improve healthcare through intelligent automation.
Full posting
Original listing.
Notable is the leading healthcare AI platform for transforming workforce productivity. Health systems, hospitals, and payers use Notable to improve healthcare quality, close gaps in patient care, drive member enrollment, and patient acquisition, retention, and reimbursement, scaling growth without hiring more staff.
We are on a mission to improve the lives of patients, staff, and clinicians - to improve healthcare for humanity. This isn't just a lofty goal - it's something we're achieving every single day. When you join Notable, you become part of a force actively transforming healthcare. Our aim to impact 100 million patients isn't just a number; it's a commitment to creating meaningful change on a massive scale.
Therefore, our culture is purposeful in pursuit of this mission. We believe our culture gives each person the opportunity to do the best work of their lives, work with the best teammates, and have fun achieving great things together.
Role Summary:
Notable is transforming healthcare with intelligent automation. As a Security Engineer Intern, you will help design, build, and automate controls that protect our platform and data, partnering closely with Security, Infrastructure, and Product Engineering.
What You’ll Do:
Build and automate security controls and guardrails in collaboration with Security and Infra (examples: IaC policy checks, least‑privilege baselines, automated secrets detection in CI/CD).
Create or tune detections and response playbooks for key risks; validate via simulation and document runbooks.
Contribute to secure-by-default developer workflows (pre-commit hooks, SAST/DAST pipelines, dependency scanning) and help triage/track findings to closure.
Implement small, measurable improvements to cloud security posture (e.g., misconfiguration checks, logging/telemetry coverage, tagging/ownership hygiene).
Write clear documentation and operational SOPs for what you build; hand off with measurable acceptance criteria.
Partner on security reviews for low-to-medium risk changes and help track mitigations.
You’re a Great Fit if:
You’ve built things: coursework or projects in security engineering, cloud, or DevSecOps; comfortable reading code and automating with at least one language (Python, Go, or similar).
Familiar with common security domains such as cloud security (GCP/AWS/Azure), identity and access management, CI/CD security, container/Kubernetes basics, or detection engineering.
You love to automate, measure outcomes, and leave systems better documented than you found them.
Strong communicator; can turn ambiguous problems into a small, shippable plan with milestones.
Nice to Have:
Hands-on with infrastructure-as-code (Terraform), policy-as-code (OPA/Conftest), and CI systems (GitHub Actions, GitLab, or similar).
Experience with log pipelines and SIEM/analytics tools; basic detection authoring.
Familiarity with secure software development practices and OWASP Top 10.
Exposure to healthcare, regulated environments, or privacy-centric design.
#LI-TD1
We value in-person collaboration and connection. For Bay Area–based employees, this role requires being in our San Mateo office at least three days a week. For remote employees, occasional travel to headquarters is expected for company-wide events and onsite gatherings.
Beware of job scam fraudsters! Our recruiters use @notablehealth.com email addresses exclusively. We do not conduct interviews via text or instant message, to purchase equipment through us, or to provide sensitive personally identifiable information such as bank account or social security numbers. If you have been contacted by someone claiming to be a recruiter from Notable from a different domain about a job offer, please report it as potential job fraud to law enforcement and contact us here.
Redirects to Notable's application page.
Other roles