Blue Shield of California

Design and operate security-as-code across application, cloud, and infrastructure environments using automation and developer-native platforms. | 10+ years experience with 8+ years in DevSecOps, Security Engineering, or Software Engineering, proficiency in Python, Go, or TypeScript, and hands-on with Infrastructure-as-Code tools like Terraform. | Your Role  The Product Security team builds and operates engineering-driven security capabilities embedded directly into the software and platform lifecycle. The Product Security Engineer will report to the Senior Director, Product Security. In this role you will design, build, and operate security as code across application, data, cloud, and infrastructure environments, ensuring secure-by-default outcomes through automation and developer-native platforms. You will play a key role in securing AI-enabled systems and leveraging AI to scale security engineering, detection, and response capabilities. Our leadership model is about developing great leaders at all levels and creating opportunities for our people to grow – personally, professionally, and financially. We are looking for leaders that are energized by creative and critical thinking, building and sustaining high-performing teams, getting results the right way, and fostering continuous learning. RESPONSIBILITIES Your Work  In this role, you will:  * Design and operate security controls embedded in CI/CD pipelines using policy-as-code and automation-first approaches * Build and maintain developer-native security platforms covering SAST, SCA, API validation, and IaC security * Implement data protection controls to detect and prevent exposure of sensitive data including PHI, PII, and secrets * Develop secure application and API patterns including authentication, authorization, and encryption standards * Engineer reusable libraries for encryption, tokenization, and data redaction * Define and enforce cloud and infrastructure security using Infrastructure-as-Code and GitOps workflows * Build identity, access, encryption, and network guardrails using automated controls * Implement software supply chain security including SBOM generation, artifact signing, and provenance validation * Develop detection-as-code and automated response capabilities to reduce reliance on manual security operations * Design and enforce controls to secure AI systems and prevent misuse, data leakage, and model risk * Leverage AI to improve detection, analysis, and automation across security operations * Translate regulatory requirements into enforceable technical controls and automated evidence generation * Eliminate manual security processes in favor of scalable engineering-driven solutions QUALIFICATIONS Your Knowledge and Experience  * Requires college degree or equivalent experience * Requires a minimum of at least 10 years of relevant experience * 8+ years in DevSecOps, Security Engineering, or Software Engineering preferred * Strong experience building security capabilities into CI/CD pipelines * Hands-on experience with Infrastructure-as-Code tools such as Terraform * Proficiency in Python, Go, or TypeScript * Deep understanding of application security, cloud security, and distributed systems * Experience securing Kubernetes or cloud-native environments * Strong understanding of IAM, encryption, and network security principles * Experience with policy-as-code tools such as OPA or Kyverno * Experience with AI/ML systems or applying AI to security problems preferred * Experience in regulated environments such as healthcare preferred   #LI-FB1 About Stellarus and the Ascendiun Family of Companies Stellarus, launched in January 2025, is designed to scale innovative healthcare solutions that support customers in creating a health care experience deserving of their family, friends, and neighbors.       Stellarus is part of a family of organizations that is overseen by a nonprofit corporate entity named Ascendiun. The Ascendiun Family of Companies also includes Blue Shield of California and its subsidiary, Blue Shield of California Promise Health Plan and Altais, a clinical services company.  Stellarus’ vision is to empower its customers to create a healthcare experience that is worthy of their family, friends, and neighbors. Stellarus’ objective is to offer innovative, modern, scalable solutions that challenge the health care status quo. This very closely aligns with Blue Shield of California’s vision by using innovation to improve quality, affordability, and experience for members.    To achieve our mission, we foster an environment where all employees can thrive and contribute fully to address the needs of the various communities we serve. We are committed to creating and maintaining a supportive workplace that upholds our values and advances our goals. Our Values:  At Stellarus, our core values of agility, trust, drive, courage and service shape our approach to developing innovative product offerings. Our Workplace Model:  We believe in fostering a workplace environment that balances purposeful in-person collaboration with flexibility - providing clear expectations while respecting the diverse needs of our workforce. Our workplace model is designed around intentional in-person interaction, collaboration, connection, creativity and flexibility: * For most teams, this means coming into the office two days per week. * Employees living more than 50 miles from an office location, out of state employees, and employees in certain member-facing roles should work with their manager to determine in-office time based on business need. * For employees with medical conditions that may impact their ability to work in-office, we are committed to engaging in an interactive process and providing reasonable accommodations to ensure their work environment is conducive to their success and well-being. The Company reserves the right to require more presence in the office based on business needs, and requirements are subject to change with periodic reviews. Physical Requirements: Office Environment - roles involving part to full time schedule in Office Environment. Based in our physical offices and work from home office/deskwork - Activity level: Sedentary, frequency most of work day. Please click here for further physical requirement detail. [https://www.blueshieldca.com/physical-job-requirements]  Equal Employment Opportunity: External hires must pass a background check/drug screen. Qualified applicants with arrest records and/or conviction records will be considered for employment in a manner consistent with Federal, State and local laws, including but not limited to the San Francisco Fair Chance Ordinance. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, national origin, sexual orientation, gender identity, protected veteran status or disability status and any other classification protected by Federal, State and local laws.

Translate regulatory and security requirements into governance practices and coordinate audit evidence and remediation. | Bachelor's degree and 7+ years in security assurance and trust frameworks with strong communication skills. | Your Role The Information Security Team is seeking an Information Security Risk and Governance Specialist.  In this role, you will be supporting Stellarus by helping translate regulatory, contractual, policy, and security requirements into sustainable and measurable governance and control practices.   Stellarus recognizes that IT Services are crucial, strategic, organizational assets and therefore we must invest appropriate levels of resource into the support, delivery and management of these critical IT Services and the IT systems that underpin them. This position has responsivities within the Information Security Compliance organization, for maturing the Compliance function, ensuring IT audit-readiness with policy, regulations and control standards. RESPONSIBILITIES Your Work  In this role, you will: GRC Program Operations & Reporting * Maintain accurate information within GRC systems, control repositories, risk registers, policy repositories, and assurance trackers. * Contribute to the development and maintenance of dashboards and reporting regarding security risks, control performance, exceptions, audit activity, findings, and remediation. * Support development and continuous improvement of GRC processes, methodologies, templates, procedures, and operating standards. Application & Technology Governance * Support governance processes that establish visibility into applications, systems, infrastructure, data environments, and technology services subject to security requirements. * Partner with technology teams to incorporate security governance requirements into the technology lifecycle, including implementation, material changes, and retirement. * Maintain mappings between applications/technology assets and applicable risks, controls, owners, frameworks, and evidence. * Assist in determining which applications and technology components are in scope for applicable regulatory and assurance frameworks.  Audit & Assessment Support * Serve as a liaison between internal/external auditors/assessors and internal control owners. * Coordinate information security evidence and responses for internal audits, external audits, customer assessments, regulatory reviews, and certification activities. * Maintain organized, reusable evidence repositories to reduce duplicative requests and audit fatigue. * Support readiness activities associated with SOC 2, NIST, HIPAA, HITRUST, and other applicable assessments. Information Security Risk Management * Support information security risk management program, including identification, assessment, documentation, treatment, monitoring, and reporting of technology and cybersecurity risks. * Support development of security risk metrics, key risk indicators, dashboards, and management reporting. * Monitor open risks, exceptions, findings, and remediation commitments and facilitate escalation of overdue or high-risk items. * Facilitate security risk assessments for systems, applications, technologies, business processes, and organizational changes. * Maintain security risk assessments for systems, applications, technologies, business processes, and organizational changes. Control Assurance & Monitoring * Perform or coordinate control self-assessments and evidence reviews. * Evaluate whether controls are appropriately designed, implemented, documented, and supported by sufficient evidence. * Track findings and remediation through closure and validate supporting evidence when appropriate. * Identify control gaps and work with control owners to establish corrective action plans. QUALIFICATIONS Your Knowledge and Experience  * Requires a bachelor's degree or equivalent experience * Requires at least 7 years of prior relevant experience * Understanding of and experience working with security assurance and trust frameworks (in particular NIST, HIPAA and SOC 2) * Experience interacting with internal/external auditors and explaining technical concepts * Ability to communicate effectively with customers and internal teams * Superior organizational skills, extraordinary attention to detail, and an agile mindset that processes can always be improved * Proven ability to manage projects and deliverables to completion * Ability to understand and contextualize complex technical concepts into terms readily understandable by a non-technical audience * Satisfactory knowledge and skills including technical or functional expertise, business acumen and financial analysis skills, risk management, critical thinking and decision-making skills. * Intermediate understanding of healthcare information security governance, risk, and compliance practices * Ability to learn and understand Stellarus’ security controls and to maintain a security knowledge base that can be used for multiple projects Additionally, candidate must be able to: * Demonstrate personal commitment to change through actions and words, and mobilize others to support change through times of stress and uncertainty * Foster a team culture of continuous improvement, mentoring and learning, data driven decisions, and accountability for delivery of key metrics and deliverables * Breakdown raw information and undefined problems into specific, workable components that in-turn clearly identifies the issues at hand * Make logical conclusions, anticipates obstacles and considers different approaches that are relevant to the decision-making process * Improve organizational performance though the application of original thinking to existing and emerging methods, processes, products and services   #LI-FB1 About Stellarus and the Ascendiun Family of Companies Stellarus, launched in January 2025, is designed to scale innovative healthcare solutions that support customers in creating a health care experience deserving of their family, friends, and neighbors.       Stellarus is part of a family of organizations that is overseen by a nonprofit corporate entity named Ascendiun. The Ascendiun Family of Companies also includes Blue Shield of California and its subsidiary, Blue Shield of California Promise Health Plan and Altais, a clinical services company.  Stellarus’ vision is to empower its customers to create a healthcare experience that is worthy of their family, friends, and neighbors. Stellarus’ objective is to offer innovative, modern, scalable solutions that challenge the health care status quo. This very closely aligns with Blue Shield of California’s vision by using innovation to improve quality, affordability, and experience for members.    To achieve our mission, we foster an environment where all employees can thrive and contribute fully to address the needs of the various communities we serve. We are committed to creating and maintaining a supportive workplace that upholds our values and advances our goals. Our Values:  At Stellarus, our core values of agility, trust, drive, courage and service shape our approach to developing innovative product offerings. Our Workplace Model:  We believe in fostering a workplace environment that balances purposeful in-person collaboration with flexibility - providing clear expectations while respecting the diverse needs of our workforce. Our workplace model is designed around intentional in-person interaction, collaboration, connection, creativity and flexibility: * For most teams, this means coming into the office two days per week. * Employees living more than 50 miles from an office location, out of state employees, and employees in certain member-facing roles should work with their manager to determine in-office time based on business need. * For employees with medical conditions that may impact their ability to work in-office, we are committed to engaging in an interactive process and providing reasonable accommodations to ensure their work environment is conducive to their success and well-being. The Company reserves the right to require more presence in the office based on business needs, and requirements are subject to change with periodic reviews. Physical Requirements: Office Environment - roles involving part to full time schedule in Office Environment. Based in our physical offices and work from home office/deskwork - Activity level: Sedentary, frequency most of work day. Please click here for further physical requirement detail. [https://www.blueshieldca.com/physical-job-requirements]  Equal Employment Opportunity: External hires must pass a background check/drug screen. Qualified applicants with arrest records and/or conviction records will be considered for employment in a manner consistent with Federal, State and local laws, including but not limited to the San Francisco Fair Chance Ordinance. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, national origin, sexual orientation, gender identity, protected veteran status or disability status and any other classification protected by Federal, State and local laws.

Design and deliver complex application features across UI, APIs, and data layers with security and scalability, lead integrations and data modeling, support cloud readiness and monitoring, and mentor teams. | At least five years full-stack development experience, proficiency with modern frontend frameworks, backend services, databases, REST integrations, cloud-native development, containerization, Infrastructure as Code, CI/CD, version control, and AI-assisted coding; bachelor's degree required. | Role   As a Full Stack Engineer in the healthcare space, you’ll architect seamless, mission‑critical applications that clinicians and patients depend on. From polished interfaces to high‑performance backends, you’ll shape technology that improves care delivery and enhances lives. Our leadership model is about developing great leaders at all levels and creating opportunities for our people to grow – personally, professionally, and financially. We are looking for leaders that are energized by creative and critical thinking, building and sustaining high-performing teams, getting results the right way, and fostering continuous learning.  RESPONSIBILITIES Your Work   In this role, you will:   * Own the end-to-end design and delivery of complex application features across UI, API, and data layers, ensuring scalability, security, and alignment with architectural standards. * Develop secure, testable, and maintainable code aligned with modern architectural patterns * Lead implementation of system integrations and data models for distributed systems, addressing complexity, edge cases, and performance considerations. * Ensure applications are cloud-ready and compatible with established CI/CD workflows * Contribute to application logging, monitoring, and diagnostics to support operational visibility * Leverage AI tools to enhance productivity, code quality, and documentation, while critically applying outputs * Partner closely with cross-functional teams to translate ambiguous requirements into scalable technical solutions, providing technical guidance and design input to peers. * Provide technical guidance and informal mentorship to less experienced engineers through design and code reviews QUALIFICATIONS Your Knowledge and Experience   * 5+ years of experience in full stack development * BA/BS or equivalent IT experience * Proficiency in modern front-end frameworks (React, Vue, Angular or similar) and JavaScript/TypeScript * Experience building backend services and APIs using .NET, Java, Node.js, Python, or similar technologies * Strong knowledge of SQL (e.g., MS SQL Server, Oracle) and/or NoSQL databases and RESTful integrations * Experience developing cloud-native applications (Azure preferred; AWS/GCP acceptable) * Experience with containerization (e.g., Docker) * Familiarity using Infrastructure as Code (e.g., Ansible, Bicep, ARM, Terraform) to provision and manage cloud resources * Working knowledge of CI/CD pipelines and version control systems (e.g., GitHub, GitLab, Bitbucket) * Experience using AI-assisted coding tools in professional software development (e.g., GitHub Copilot, Cursor, Claude, or similar) * Experience working in regulated environments (e.g., healthcare) preferred * Familiarity with healthcare interoperability standards or enterprise healthcare platforms (e.g., Epic) preferred   * End-to-end ownership mindset – thinks about UI, logic, and data as one cohesive system * Engineering pragmatism – balances ideal architecture with delivery speed and business value * AI-augmented builder – leverages AI tools effectively while maintaining strong engineering judgment * Effective collaboration with product, design, QA, security, and platform teams * Ability to operate in dynamic, evolving environments with shifting priorities * Clear communication of technical concepts to both technical and non-technical stakeholders   Hybrid This role requires employees to be in-office based on our hybrid workplace model, balancing purposeful in-person collaboration with flexibility. For most teams, this means coming into the office two days each week. Employees living more than 50 miles from an office location will work with their manager to determine in-office time based on business need.  #LI-JA1 About Stellarus and the Ascendiun Family of Companies Stellarus, launched in January 2025, is designed to scale innovative healthcare solutions that support customers in creating a health care experience deserving of their family, friends, and neighbors.       Stellarus is part of a family of organizations that is overseen by a nonprofit corporate entity named Ascendiun. The Ascendiun Family of Companies also includes Blue Shield of California and its subsidiary, Blue Shield of California Promise Health Plan and Altais, a clinical services company.  Stellarus’ vision is to empower its customers to create a healthcare experience that is worthy of their family, friends, and neighbors. Stellarus’ objective is to offer innovative, modern, scalable solutions that challenge the health care status quo. This very closely aligns with Blue Shield of California’s vision by using innovation to improve quality, affordability, and experience for members.    To achieve our mission, we foster an environment where all employees can thrive and contribute fully to address the needs of the various communities we serve. We are committed to creating and maintaining a supportive workplace that upholds our values and advances our goals. Our Values:  At Stellarus, our core values of agility, trust, drive, courage and service shape our approach to developing innovative product offerings. Our Workplace Model:  We believe in fostering a workplace environment that balances purposeful in-person collaboration with flexibility - providing clear expectations while respecting the diverse needs of our workforce. Our workplace model is designed around intentional in-person interaction, collaboration, connection, creativity and flexibility: * For most teams, this means coming into the office two days per week. * Employees living more than 50 miles from an office location, out of state employees, and employees in certain member-facing roles should work with their manager to determine in-office time based on business need. * For employees with medical conditions that may impact their ability to work in-office, we are committed to engaging in an interactive process and providing reasonable accommodations to ensure their work environment is conducive to their success and well-being. The Company reserves the right to require more presence in the office based on business needs, and requirements are subject to change with periodic reviews. Physical Requirements: Office Environment - roles involving part to full time schedule in Office Environment. Based in our physical offices and work from home office/deskwork - Activity level: Sedentary, frequency most of work day. Please click here for further physical requirement detail. [https://www.blueshieldca.com/physical-job-requirements]  Equal Employment Opportunity: External hires must pass a background check/drug screen. Qualified applicants with arrest records and/or conviction records will be considered for employment in a manner consistent with Federal, State and local laws, including but not limited to the San Francisco Fair Chance Ordinance. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, national origin, sexual orientation, gender identity, protected veteran status or disability status and any other classification protected by Federal, State and local laws.