Security Engineer Intern

Security Engineer · Intern · Internship

San Mateo, CAUSD 30 – 502mo ago
Apply for this role

Opens Notable's application page

Role

What you'll do.

As a Security Engineer Intern at Notable, you'll design and automate security controls protecting a healthcare AI platform serving millions of patients. You'll collaborate with security and infrastructure teams to build infrastructure-as-code policy checks, detection playbooks, and secure-by-default developer workflows while contributing to cloud security posture improvements in a regulated healthcare environment.

Responsibilities

  • Build and Automate Security Controls: Design, develop, and deploy automated security controls and guardrails in collaboration with Security and Infrastructure teams. This includes implementing Infrastructure-as-Code (IaC) policy checks, establishing least-privilege baseline configurations, and integrating automated secrets detection into CI/CD pipelines to enforce security standards across the development lifecycle.
  • Create Detection and Response Playbooks: Author detection rules and incident response playbooks for identified security risks affecting the healthcare platform. Validate effectiveness through controlled simulation exercises, document comprehensive runbooks with clear decision trees, and establish measurable metrics for detection accuracy and response times.
  • Enhance Secure Development Workflows: Contribute to the implementation of secure-by-default developer practices including pre-commit security hooks, SAST/DAST pipeline integration, and automated dependency scanning. Collaborate on triaging, prioritizing, and tracking security findings through remediation and closure to maintain a healthy security posture.
  • Improve Cloud Security Posture: Identify and implement measurable security improvements across cloud infrastructure including misconfiguration detection, logging and telemetry coverage expansion, and resource tagging hygiene. Focus on addressing low-to-medium risk gaps that enhance the overall security foundation of the platform.
  • Document Security Operations: Create clear, maintainable documentation and standard operating procedures for all developed security tools and controls. Establish measurable acceptance criteria for handoffs, ensure operational clarity for team adoption, and maintain living documentation that evolves with security improvements.
  • Support Security Change Reviews: Participate in security review processes for low-to-medium risk changes to the platform. Track identified mitigations, validate remediation efforts, and provide technical feedback to ensure changes maintain or enhance the security posture of healthcare systems serving millions of patients.

Qualifications

What we look for.

Technical

  • Programming and Scripting

    Hands-on experience with at least one programming language such as Python, Go, or similar for automating security controls and building tooling. Demonstrated ability to read and analyze code for security implications.

  • Cloud Security Fundamentals

    Working knowledge of cloud security concepts and platforms including GCP, AWS, or Azure. Understanding of cloud-native security challenges, misconfiguration risks, and cloud-specific security best practices.

  • CI/CD and DevSecOps Concepts

    Familiarity with CI/CD pipeline security, continuous integration systems, and DevSecOps practices. Understanding of how to integrate security controls into development workflows.

  • Infrastructure-as-Code Basics

    Understanding of IaC principles and experience with tools like Terraform for defining and managing cloud infrastructure. Knowledge of policy-as-code frameworks such as OPA or Conftest for automated compliance.

  • Container and Kubernetes Basics

    Foundational knowledge of containerization, Docker, and Kubernetes security concepts. Understanding of container security risks and best practices for securing containerized workloads.

  • Identity and Access Management

    Understanding of IAM principles, least-privilege access design, role-based access control (RBAC), and authentication/authorization mechanisms in cloud environments.

Education

  • Computer Science or Related Field

    Bachelor's degree in Computer Science, Cybersecurity, Information Security, or related technical discipline, or equivalent demonstrated coursework in security engineering.

  • Security Engineering Coursework

    Completion of courses or projects in security engineering, cloud security, or DevSecOps demonstrating foundational knowledge of security principles and practices.

Experience

  • Hands-On Security Projects

    Demonstrated experience through coursework, personal projects, or internships building security tools, implementing controls, or solving security engineering problems.

  • Automation and System Design

    Experience automating repetitive security tasks, designing measurable improvements to systems, and documenting solutions for operational sustainability.

  • Problem-Solving and Communication

    Proven ability to translate ambiguous security problems into concrete, prioritized plans with clear milestones. Strong verbal and written communication skills for technical and non-technical audiences.

Skills

Required

  • Python or Go Programming

    Proficiency in Python, Go, or similar language for writing security tools, automation scripts, and control logic.

  • Cloud Platform Knowledge

    Working understanding of at least one major cloud platform (GCP, AWS, Azure) including core services, security features, and configuration best practices.

  • Security Fundamentals

    Core understanding of security principles including confidentiality, integrity, availability, authentication, authorization, and encryption.

  • Scripting and Automation

    Ability to write scripts and automation code to reduce manual security tasks and enforce security policies programmatically.

  • Technical Documentation

    Clear written communication ability to document security controls, operational procedures, and technical decisions for team consumption and future reference.

Preferred

  • Terraform Experience

    Nice to have

    Hands-on experience with Terraform for infrastructure-as-code, including writing and testing Terraform configurations and modules.

  • Policy-as-Code Tools

    Nice to have

    Familiarity with policy-as-code frameworks such as OPA (Open Policy Agent), Conftest, or similar tools for automated compliance and security validation.

  • GitHub Actions or GitLab CI

    Nice to have

    Experience with CI/CD platforms and systems, particularly GitHub Actions or GitLab CI for building secure development pipelines.

  • Log Analysis and SIEM Tools

    Nice to have

    Experience with log aggregation, analysis platforms, and SIEM tools for security monitoring and event investigation.

  • Detection Engineering

    Nice to have

    Basic experience authoring security detection rules, alerts, or signatures for identifying threats in logs or network traffic.

  • OWASP Top 10 Knowledge

    Nice to have

    Familiarity with OWASP Top 10 vulnerabilities and secure software development practices for building resilient applications.

  • Healthcare Compliance Exposure

    Nice to have

    Familiarity with healthcare-specific regulations such as HIPAA, BAA requirements, or regulated environment compliance considerations.

  • Privacy-Centric Design

    Nice to have

    Understanding of privacy-by-design principles and data protection considerations relevant to healthcare technology platforms.

Tech stack

Languages

PythonGoHCLYAML

Frameworks

GitHub ActionsGitLab CIKubernetes

Databases

Security Information and Event Management (SIEM)

Tools

TerraformOPA / ConftestSAST/DAST ToolsDependency Scanning ToolsGCP / AWS / Azure

Other

Infrastructure-as-Code (IaC)Secrets ManagementContainer SecurityIdentity and Access Management (IAM)HIPAA Compliance

Compensation

Pay and benefits.

Base·USD 30 – 50

Benefits

  • Healthcare Impact Mission

    Join a company dedicated to transforming healthcare and improving the lives of patients, staff, and clinicians. Contribute to Notable's goal of positively impacting 100 million patients through intelligent automation and security excellence.

  • Meaningful Work Environment

    Be part of a purposeful culture focused on doing the best work of your life while working alongside exceptional teammates committed to creating meaningful change in healthcare technology.

  • Hands-On Learning Opportunity

    Gain practical experience in modern security engineering including cloud security, DevSecOps, infrastructure-as-code, and security automation in a fast-growing healthcare technology company.

  • Mentorship from Security Experts

    Work directly with experienced Security and Infrastructure engineers who will guide your professional development and expose you to industry best practices in security engineering.

  • Collaborative Team Environment

    Partner with Security, Infrastructure, and Product Engineering teams in a culture that values collaboration, clear communication, and shared success in protecting sensitive healthcare data.

  • Bay Area Office Location

    Work in San Mateo, California with in-person collaboration three days per week, providing networking opportunities and access to the Bay Area's thriving technology and healthcare ecosystem.

Process

Interview steps.

  1. 01

    Initial Screening

    Phone or video screening with Notable recruiter to discuss your background in security engineering, coursework projects, and interest in healthcare technology and DevSecOps.

  2. 02

    Technical Assessment

    Coding or technical problem-solving round focused on scripting (Python/Go), cloud concepts, or security fundamentals. May include questions about infrastructure-as-code or security control design.

  3. 03

    Security Engineering Interview

    Technical interview with a Security Engineer or Infrastructure team member covering hands-on security scenarios, detection engineering concepts, and your approach to automating security controls.

  4. 04

    System Design and Collaboration

    Discussion around designing security solutions for ambiguous problems, breaking down requirements into milestones, and communicating technical concepts clearly to both technical and non-technical stakeholders.

  5. 05

    Team Fit and Values Alignment

    Conversation with team members or hiring manager about Notable's culture, your motivation for healthcare technology, and alignment with the company's mission to improve healthcare through intelligent automation.

Full posting

Original listing.

Notable is the leading healthcare AI platform for transforming workforce productivity. Health systems, hospitals, and payers use Notable to improve healthcare quality, close gaps in patient care, drive member enrollment, and patient acquisition, retention, and reimbursement, scaling growth without hiring more staff.

We are on a mission to improve the lives of patients, staff, and clinicians - to improve healthcare for humanity. This isn't just a lofty goal - it's something we're achieving every single day. When you join Notable, you become part of a force actively transforming healthcare. Our aim to impact 100 million patients isn't just a number; it's a commitment to creating meaningful change on a massive scale.

Therefore, our culture is purposeful in pursuit of this mission. We believe our culture gives each person the opportunity to do the best work of their lives, work with the best teammates, and have fun achieving great things together.

Role Summary:

Notable is transforming healthcare with intelligent automation. As a Security Engineer Intern, you will help design, build, and automate controls that protect our platform and data, partnering closely with Security, Infrastructure, and Product Engineering.

What You’ll Do:

  • Build and automate security controls and guardrails in collaboration with Security and Infra (examples: IaC policy checks, least‑privilege baselines, automated secrets detection in CI/CD).

  • Create or tune detections and response playbooks for key risks; validate via simulation and document runbooks.

  • Contribute to secure-by-default developer workflows (pre-commit hooks, SAST/DAST pipelines, dependency scanning) and help triage/track findings to closure.

  • Implement small, measurable improvements to cloud security posture (e.g., misconfiguration checks, logging/telemetry coverage, tagging/ownership hygiene).

  • Write clear documentation and operational SOPs for what you build; hand off with measurable acceptance criteria.

  • Partner on security reviews for low-to-medium risk changes and help track mitigations.

You’re a Great Fit if:

  • You’ve built things: coursework or projects in security engineering, cloud, or DevSecOps; comfortable reading code and automating with at least one language (Python, Go, or similar).

  • Familiar with common security domains such as cloud security (GCP/AWS/Azure), identity and access management, CI/CD security, container/Kubernetes basics, or detection engineering.

  • You love to automate, measure outcomes, and leave systems better documented than you found them.

  • Strong communicator; can turn ambiguous problems into a small, shippable plan with milestones.

Nice to Have:

  • Hands-on with infrastructure-as-code (Terraform), policy-as-code (OPA/Conftest), and CI systems (GitHub Actions, GitLab, or similar).

  • Experience with log pipelines and SIEM/analytics tools; basic detection authoring.

  • Familiarity with secure software development practices and OWASP Top 10.

  • Exposure to healthcare, regulated environments, or privacy-centric design.

#LI-TD1

We value in-person collaboration and connection. For Bay Area–based employees, this role requires being in our San Mateo office at least three days a week. For remote employees, occasional travel to headquarters is expected for company-wide events and onsite gatherings.

Beware of job scam fraudsters! Our recruiters use @notablehealth.com email addresses exclusively. We do not conduct interviews via text or instant message, to purchase equipment through us, or to provide sensitive personally identifiable information such as bank account or social security numbers. If you have been contacted by someone claiming to be a recruiter from Notable from a different domain about a job offer, please report it as potential job fraud to law enforcement and contact us here.

Redirects to Notable's application page.

Other roles

More at Notable.