---
title: 'Application Security Engineer at Heartflow'
canonical: 'https://feeny.ai/job/application-security-engineer-heartflow-san-francisco-wag693jpxxx2'
type: 'job'
last_seen: '2026-09-14'
---

# Application Security Engineer at Heartflow

- **Company:** Heartflow
- **Location:** San Francisco, CA
- **Posted:** 2026-09-03
- **Last confirmed live:** 2026-09-14
- **Apply:** https://job-boards.greenhouse.io/heartflowinc/jobs/6181902004

## Job description

Heartflow is a medical technology company advancing the diagnosis and management of coronary artery disease, the #1 cause of death worldwide, using cutting-edge technology. The flagship product—an AI-driven, non-invasive cardiac test supported by the ACC/AHA Chest Pain Guidelines called the Heartflow FFRCT Analysis—provides a color-coded, 3D model of a patient’s coronary arteries indicating the impact blockages have on blood flow to the heart. Heartflow is the first AI-driven non-invasive integrated heart care solution across the CCTA pathway that helps clinicians identify stenoses in the coronary arteries (RoadMap™Analysis), assess coronary blood flow (FFRCT Analysis), and characterize and quantify coronary atherosclerosis (Plaque Analysis). Our pipeline of products is growing and so is our team; join us in helping to revolutionize precision heartcare.

Heartflow is a publicly traded company (HTFL) that has received international recognition for exceptional strides in healthcare innovation, is supported by medical societies around the world, cleared for use in the US, UK, Europe, Japan and Canada, and has been used for more than 750,000 patients worldwide.

We are looking for an Application Security Engineer to work with our engineering team to ensure security is an integral part of our Software Development Lifecycle (SDLC). In this role, you’ll have the chance to use your security and software development background to protect patients as we build products that leverage AI to improve healthcare. If you enjoy working with talented engineers to solve complex technical challenges and want to see your work make a direct difference in patient outcomes, we encourage you to apply. This role is a hybrid, requiring three days a week in our San Francisco office.

What You’ll Do:

- Partner with the engineering team to provide hands-on technical guidance to software developers throughout the vulnerability remediation lifecycle. Perform secure code reviews, validate false positive determinations, coach developers on effective remediation strategies, threat model our products and carry out essential parts of a secure SDLC.
- Drive vulnerability identification using SAST, DAST, SCA and in-house AI tooling and manage external penetration testing.
- Support engineering team on vulnerability management, including risk assessment, remediation, improving identification of vulnerabilities and translate security and privacy requirements into technical requirements.
- Build security awareness through training on secure coding practices, security standards and latest security threats.

What You Bring:

- Security Communication – Ability to reason about risk in complex environments and communicate that risk to technical and non-technical audiences. Experience leading training, speaking internally/externally about security projects valued.
- Programming Skills  – Experience writing and maintaining code in at least one modern programming language and with at least one scripting language (Heartflow uses C++/Python). Comfortable with testing frameworks and CI/CD pipelines.
- AI Development Tools – Experience using AI code tools such as Claude Code and Github Copilot for development and security testing.
- Education & Experience  – BS in Computer Science (or related degree) or relevant certifications and equivalent experience. 5+ years of total experience with at least 1 year working in Application Security or performing security tasks in a development role.
- Securing SDLC – Have contributed to secure SDLC activities, including threat modeling, code review, security testing and vulnerability management.
- Knowledge of Modern AI Security Threats – Experience working with or ability to discuss current AI threats for both machine learning and generative AI.

What Helps You Stand Out:

- Healthcare Experience – Current knowledge of HIPAA, HITRUST and the complexities of working in a regulated environment. Experience with Software as a Medical Device (SaMD) is especially valuable.
- Infrastructure as Code & Cloud – Familiarity with AWS (or equivalent cloud providers) and configuration tools (Terraform, Chef, Ansible). Experience with containerization (Docker, Kubernetes) and orchestration (GitHub Actions or similar).

A reasonable estimate of the base salary compensation range is $145,000 to $180,000 per year, bonus, and equity. #LI-IB1 Heartflow is an Equal Opportunity Employer. We are committed to a work environment that supports, inspires, and respects all individuals and do not discriminate against any employee or applicant because of race, color, religion, marital status, age, national origin, ancestry, physical or mental disability, medical condition, pregnancy, genetic information, gender, sexual orientation, gender identity or expression, veteran status, or any other status protected under federal, state, or local law. This policy applies to every aspect of employment at Heartflow, including recruitment, hiring, training, relocation, promotion, and termination.

Positions posted for Heartflow are not intended for or open to third party recruiters / agencies. Submission of any unsolicited resumes for these positions will be considered to be free referrals.

Heartflow has become aware of a fraud where unknown entities are posing as Heartflow recruiters in an attempt to obtain personal information from individuals as part of our application or job offer process. Before providing any personal information to outside parties, please verify the following: A) all legitimate Heartflow recruiter email addresses end with “@heartflow.com” and B) the position described is found on our careers site at [www.heartflow.com/about/careers/](https://www.heartflow.com/about/careers/).

## About Heartflow

## Company Overview
- **One-liner**: Heartflow is a medical technology company that leverages AI to create personalized 3D models of the heart from a single CT scan, enabling clinicians to diagnose, treat, and manage coronary artery disease (CAD) non-invasively.
- **Entity Type**: Public (NASDAQ: HTFL) – IPO in 2025
- **Headquarters**: San Francisco, California, USA
- **Founded**: 2007
- **Founders**: Not publicly listed on primary company pages; the company was founded by a team including Dr. Charles Taylor (inventor of the core technology). *Note: Founders not explicitly named on the main website.*

## Core Business
- **Primary Industry**: Medical Technology / HealthTech / AI-Driven Diagnostics (Cardiology)
- **Target Customers**: B2B – Hospitals, health systems, and cardiology clinics; the end-users are clinicians (cardiologists, radiologists) and the ultimate beneficiaries are patients with suspected or known CAD.
- **Mission/Purpose**: To transform coronary artery disease (CAD) from the leading cause of death into a disease that can be managed for life.

## Products & Services
- **Heartflow One Platform**: The company’s core AI-driven, non-invasive precision coronary care platform. It provides a suite of analyses from a single Coronary CTA (CCTA) scan:
    - **Roadmap™ Analysis**: Visualizes the coronary anatomy and assesses blood flow anywhere in the coronary tree.
    - **FFRct Analysis**: Computes Fractional Flow Reserve from CT, determining the functional significance of a blockage (the original, most established product).
    - **Plaque Analysis**: Quantifies and characterizes plaque to inform risk stratification and disease management.
    - **Type**: SaaS/Software-as-a-Medical-Device (SaMD) integrated into clinical workflow.

## Market Standing
- **Valuation/Market Cap**: Not publicly available from the provided sources. As a recently public company (2025), market cap fluctuates. *Source: LinkedIn indicates a 2025 IPO.*
- **Key Metric**: Over **650,000 patients treated**; over **1,800 institutions** using the platform; **99.5% of U.S. lives covered** for FFRct Analysis.
- **Notable Investors/Partners**: Not listed in the provided search results. The company is now public.
- **Growth Signals**:
    - Supported by scientific statements from the American College of Cardiology (ACC) and American Heart Association (AHA) for personalized CAD management.
    - Late-breaking data at AHA 2025 reinforced the prognostic power of its Plaque Analysis.
    - Growing evidence base across the CAD care continuum, from risk stratification to CT-guided intervention planning.
    - Backed by **>625 peer-reviewed publications**.
    - LinkedIn follower growth: +32% year-over-year, indicating strong brand and market interest.

## Competitive Advantages
- **First-Mover & Gold Standard in FFRct**: Heartflow created the FFRct technology category and has the most robust clinical evidence base (over 625 peer-reviewed publications) and guideline support (ACC/AHA).
- **Integrated Platform (Heartflow One)**: It is the only complete, non-invasive, precision coronary care platform that covers the entire guideline-directed CCTA pathway (anatomy, physiology, and plaque).
- **Massive Clinical & Reimbursement Moat**: Achieving 99.5% U.S. lives covered creates an enormous barrier to entry for competitors, as reimbursement and clinical adoption are already deeply established.
- **AI-First, Non-Invasive Solution**: Replaces invasive diagnostic procedures (cardiac catheterization) with a safer, cheaper, and more comfortable CT scan, aligning with the industry shift toward value-based care.

## Strategic Focus
- **Deepening the Evidence Base**: Continuing to publish clinical data to expand the use cases for its platform (e.g., from diagnosis to guiding interventions).
- **Global Expansion**: Operating in the US, Europe, and Japan, with a focus on expanding access and adoption in these key markets.
- **Platformization**: Moving from a single product (FFRct) to a comprehensive CAD management platform (Heartflow One) that manages patients from screening through treatment.
- **Lifecycle Management**: Shifting the narrative from a one-time diagnostic test to a tool for managing CAD for the patient's entire life.

## Why Work Here
- **Mission-Driven**: The work directly impacts the world's leading cause of death. The company culture emphasizes a "patient-first" mentality.
- **Remote-First Culture**: The company is remote-first with employees across the US, Europe, and Japan. Hubs include San Francisco (HQ), Austin, London, and Tokyo.
- **Strong Benefits**: Medical/Dental/Vision (90% of premium paid by company), 401k match, parental leave, flexible PTO, and an Employee Assistance Program (EAP).
- **Engineering & Clinical Excellence**: A high-caliber team of engineers, data scientists, and clinicians working on cutting-edge AI in a regulated medical environment. The tech stack involves complex 3D modeling, AI/ML, and cloud infrastructure.
- **Growth Stage**: As a recently public company with strong adoption, it offers a balance of startup energy and established market stability. High growth potential in a mission-critical field.

## Sources
1. [heartflow.com (Company Overview)](https://www.heartflow.com/)
2. [heartflow.com (About Us)](https://www.heartflow.com/about/)
3. [heartflow.com (Careers Page)](https://www.heartflow.com/about/careers/)
4. [Greenhouse (Job Board)](http://job-boards.greenhouse.io/heartflowinc)
5. [LinkedIn (Company Profile)](https://www.linkedin.com/company/heartflow-inc)

## Other roles at Heartflow

- [Staff Application Database Architect](https://feeny.ai/job/staff-application-database-architect-heartflow-san-francisco-fgs696p56q9t) — San Francisco, CA
- [Workforce Management Operations Analyst](https://feeny.ai/job/workforce-management-operations-analyst-heartflow-austin-7szz7rn2gy74) — Austin, TX
- [Imaging Analyst - Austin, TX](https://feeny.ai/job/imaging-analyst-austin-tx-heartflow-austin-texas-34acr8bdv68t) — Austin Texas, United States
- [Director, Engineering](https://feeny.ai/job/director-engineering-heartflow-san-francisco-mfgyxta25m1g) — San Francisco, CA
- [Sr. Manager, Social Media & Communications](https://feeny.ai/job/sr-manager-social-media-communications-heartflow-rohnert-park-hqtnav6p6k1n) — Rohnert Park, CA / San Francisco, CA
- [Director, HR Operations & Benefits](https://feeny.ai/job/director-hr-operations-benefits-heartflow-rohnert-park-jsegawpbm26q) — Rohnert Park, CA
- [Sr. Director/VP, Strategic Partnerships](https://feeny.ai/job/sr-director-vp-strategic-partnerships-heartflow-rohnert-park-jyt35qmk9pxa) — Rohnert Park, CA
- [Territory Account Manager - Atlanta, GA](https://feeny.ai/job/territory-account-manager-atlanta-ga-heartflow-atlanta-nz7yknxpzcma) — Atlanta, GA
- [Systems Engineer III (Research)](https://feeny.ai/job/systems-engineer-iii-research-heartflow-san-francisco-ct3t2429a36t) — San Francisco, CA
- [Principal/Director, Product Management](https://feeny.ai/job/principal-director-product-management-heartflow-san-francisco-qa0zdcqx2nw7) — San Francisco, CA