Aptible Blog

Aptible | Remote | Multiple technical and non-technical roles for those interested in Internet security

https://www.aptible.com/company/

Aptible makes people-centered security products that help SaaS developer teams build security into their architecture and their organization's culture.

* Enclave is a container orchestration platform built for developers that automates security best practices and controls needed for deploying and scaling Dockerized apps in regulated industries.

* Gridiron is like the missing QuickBooks for security management. It helps developers design and run security management programs that meet and exceed requirements like HIPAA, SOC 2, and ISO 27001. Customers use it to build trust with their own customers and partners, and prepare for certifications.

Important skills we are looking for include: EmberJS, DevOps/Site Reliability, Security & Compliance (HIPAA, HITRUST, ISO 27001, SOC 2, PCI-DSS, GDPR, etc.) expertise, SaaS Operations/Generalists, and more.

We would love to talk with anyone who is interested in Internet security and has one or more of the competencies listed above. Specific roles that we are looking for today:

1. Senior Site Reliability Engineer

2. Senior Software Engineer

3. Support Engineer

4. Growth Ops (Sales Ops / Marketing Ops)

Reasons to work at Aptible:

* Small team, (relatively) large customer base filled with innovators in challenging industries (namely healthtech and fintech)

* Fully remote

* Our products have…

> Technically, we could claim that we are HIPAA compliant, as we don't store PHI

Disclaimer: I am not a lawyer, I am not your lawyer, and this is not legal advice.

There's a lot more to being HIPAA compliant than how you store PHI. As an engineer, you might view not storing PHI as compliance-by-default (the null case), but I don't think a lawyer would agree. Even if you're correct and HIPAA doesn't apply to you (which I'm not convinced is the case), it'd be like saying "we're PCI-compliant, because we don't store any financial information or process any financial transactions".

For what it's worth, I founded a company that does store PHI, and we had to get a BAA with AWS (though we ended up using Aptible (YC S14)[0] for hosting and compliance, as it's much easier. Using Aptible is like using Heroku (git push to deploy), and they manage not just the data backups/retention/etc. from a technical standpoint, but all of the human training and paperwork aspects to compliance[1].

[0] https://www.aptible.com/

[1] Which, to be honest, is the tough stuff. From a technological perspective, HIPAA doesn't really mandate much that developers of robust applications shouldn't already be doing, but it's the matter of actually demonstrating that you've done everything in compliance with the law that makes things complicated. Having the 'rubber stamp' of a third-party company that specializes in this matter gives immense peace-of-mind as the CTO, compared to the DIY approach.

Aptible (YC S14) | Senior Software Engineers, Site Reliability Engineers, and Support Engineers | Remote

At Aptible, we make people-centered security products that help developer teams build security into their architecture and their organization’s culture:

Enclave is a container orchestration platform built for developers that automates security best practices and controls needed for deploying and scaling Dockerized apps in regulated industries.

Gridiron is like the missing QuickBooks for security management. It helps developers design and run security management programs that meet and exceed requirements like HIPAA, SOC 2, and ISO 27001. Customers use it to build trust with their own customers and partners, and prepare for certifications.

Learn more at https://www.aptible.com/company/

Thanks for sharing your application with us. It's great to analyze a well thought out and well worded application.

I've posted some links below that have helped me understand their process in a little more depth, especially the interview. These links have been posted at some point on HN, but I'm just putting them here for anyone's convenience. I hope you find them useful:

http://old.ycombinator.com/howtoprepare.html

http://ycinterview.com/

http://ipaulgraham.herokuapp.com/

https://www.aptible.com/blog/y_combinator.html

http://yourstory.com/2014/10/guide-list-y-combinator/

The last one is especially helpful, it should answer just about any question and has other examples of great applications.

Aptible (YC S14) | Remote (Pacific-Eastern Time Zones) | https://www.aptible.com

Aptible helps create a more trustworthy internet by improving data security and compliance. We make it simple for modern businesses to manage compliance so that they can build customer trust.

To learn more about who we are, our culture, and whether this is the right place for you, read our Owner's Manual (https://www.aptible.com/owners-manual) and profile on Key Values (https://www.keyvalues.com/aptible).

Open Role(s):
- Security Engineer: https://jobs.lever.co/aptible/54889be8-def5-4627-965b-b92b235f93d3

Yes, that is very true.

I am planning to move my hosting to Aptible [1], and will become PCI certified and HIPAA compliant.

If anyone is interested in FormAPI, but requires PCI certification and HIPAA compliance, please send an email to compliance@formapi.io. We'll let you know when we are ready. You can also send an email to enterprise@formapi.io to inquire about on-site hosting.

[1] https://www.aptible.com/