Senior/Staff Engineer, Application & Product Security

United StatesPosted 2 months agoWebsite

Apply on Grow Therapy's site →

At a Glance

6+ years experiencePen TestingThreat ModelingSASTDAST

Full details on LinkedIn

The complete job description, requirements, and application details are available on the original posting.

About Grow Therapy

Grow Therapy is a mental health platform founded in 2020, offering both online and in-person therapy services. Based in New York, the company connects individuals with licensed therapists and psychiatrists who accept insurance, making mental health care more accessible and affordable. With a network of nearly 20,000 providers, Grow Therapy serves over 2 million patients across 47 states and Washington, D.C. The platform allows users to easily search for and book therapy and medication management sessions, with many services covered by insurance. Patients can be matched with therapists in minutes based on their specific needs. For therapists, Grow Therapy provides support in launching and growing private practices, handling administrative tasks like billing and credentialing, and offering a community for networking and referrals. The company is recognized for its insurance-friendly model and flexibility in care options, catering to the growing demand for mental health services.

Employees

3,200

116 engineers

Revenue

$1.0B

Website

Visit →

Security at Grow Therapy

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

Security Philosophy

Grow states that protecting data and maintaining trust are foundational.
Its AppSec approach is developer-enabling rather than gatekeeping: make the secure path easy, embed secure defaults and CI guardrails into the SDLC, and ship security without slowing teams down.
Risk is prioritized by real risk rather than raw vulnerability counts, using threat modeling, risk assessments, penetration testing, and remediation tracking.
Stated priorities include secure-by-default infrastructure, least privilege, continuous security visibility, systematic vulnerability management, AI-native security, data classification, privacy-preserving analytics, and consent-first AI features.
Gaps: no public leader interview or security talk was found describing scanner-noise reduction, formal AppSec SLAs, or a detailed risk-acceptance model.

Security Team

Grow Therapy’s Security function is led by Aaltan Ahmad, publicly identified as Head of Security and Director, Infrastructure and Security. Security is organized within Internal Foundations and works across Developer Experience, Platform Engineering, IT, QA, Product, Engineering, Cloud, Compliance, and Clinical. The public record identifies at least two security professionals—Aaltan Ahmad and Patrick Watters—but does not disclose total AppSec headcount. One AppSec posting references an engineering organization of roughly 145 engineers. As of, three cybersecurity postings were publicly listed: Senior/Staff Engineer, Application & Product Security; Senior/Staff Engineer, Cloud & Infrastructure Security/Data Infrastructure; and Senior/Staff Security Engineer, Incident Response. Strict AppSec-title count: one. Common patterns are secure-by-default engineering, CI guardrails, threat modeling, risk-based prioritization, AWS security, vulnerability management, automation, and AI/data security. Gaps: exact Security/AppSec team size, formal org chart, and confirmed reporting chain above the Head of Security were not publicly available

Key Initiatives

Security Champions: No evidence found of a current Grow program.
A job posting references Security Champions only as a program candidates may have built at a previous company.
Shift left: the Application & Product Security role calls for secure defaults, CI guardrails, threat modeling, security requirements, hands-on code review, risk assessments, penetration testing, vulnerability remediation, and secure coding education.
Vulnerability management: public evidence describes regular vulnerability assessments, annual third-party penetration testing, risk identification and prioritization, remediation tracking, and a target of systematic vulnerability management.
Intake sources publicly named: vulnerability assessments, penetration testing, threat intelligence, and security incidents.
Secure SDLC artifacts include security requirements, threat modeling, secure coding education, code review, risk assessments, penetration testing, security reviews, and security metrics reporting.
Recent stated initiatives include secure-by-default authentication, authorization, audit logging and egress-control services.
Automated least-privilege and vulnerability-management capabilities.
Security scorecards.
Automated data classification and tagging.
Masking, tokenization, encryption and key-management pipelines.
Secure AI-data connectors.
AI-risk management.
Privacy-preserving analytics following the Neosync acquisition. The Neosync announcement is ⚠️ stale because it was published. Claims are.
No case study was used.

Preparing for an AppSec interview?

Get the weekly briefing 2,000+ security pros trust.

Interested in this role?

Apply on Grow Therapy's site