Senior Security Engineer

Description

The company is a cloud-based healthcare communications platform used by clinical teams for both in-person and remote care. It launched in 2016 and now supports more than 50,000 healthcare professionals, from solo practices to large multi-site, multi-specialty groups.

The platform covers telemedicine, telephony, secure messaging, team collaboration, and workflow automation. It is used by small and medium-sized medical practices across the United States and holds a 4.9+ rating from over 100K reviews.

This is a new, foundational role: the first engineer at the company dedicated entirely to security. You will report directly to the CTO on a fully remote, small engineering team and cover every entry point, including the application, infrastructure, people, IT systems, and employee devices.

Security is already shared across the whole company. Your job is to make it easier for everyone to do it well. You will take over work that is currently spread across the team, move concrete projects forward, and shape how security is discussed and prioritized as the company grows. As the in-house expert, you will advise teammates on connecting AI agents to new systems, adding vendors, shipping sensitive features, and handling unusual support requests.

The backend is Go services communicating over gRPC, with client-facing APIs defined in GraphQL. The web and desktop apps use TypeScript and React, running in the browser and as an Electron app. Mobile apps are native: Swift and Objective-C on iOS, Kotlin and Java on Android. Infrastructure is managed with Terraform on AWS. The company is fully remote, uses Mac endpoints, and reaches internal tools over a VPN.

The systems you protect run in a high-reliability healthcare setting where correctness, security, and uptime are critical. Your decisions directly affect clinical workflows and customer data.

A good fit for this role measures success by risks actually closed and is willing to do any task needed to resolve an issue.

Responsibilities

• Build and own the security roadmap across every entry point, prioritizing by risk and feasibility, and track progress over time
• Secure AI use across the company, covering the tools and agents staff use and the AI features the company ships
• Own endpoint security and MDM for the remote team, keeping machines that reach sensitive internal tools locked down without slowing people down
• Strengthen support protocols and tooling against social engineering so sensitive customer requests are verified securely and consistently
• Pen-test the product and review code across the stack to protect customer data, using AI to find vulnerabilities faster and driving fixes to completion
• Work with the infrastructure team on ongoing security reviews of AWS, and lock down access to code repositories, CI/CD, and internal systems
• Work with leadership on the SOC 2 and HIPAA compliance programs, and vet new vendors and security partners
• Lead security incident response and monitoring, test that defenses detect simulated attacks, and run company-wide training

Requirements

• 8+ years in security engineering, including owning security at a distributed software company, ideally in healthcare or another regulated environment with SOC 2 or HIPAA obligations
• Broad experience across application, cloud (AWS), and corporate security, with depth in at least one area
• Hands-on experience running MDM and endpoint security for a remote macOS fleet
• Proven offensive skills, including penetration testing, red teaming, and social engineering
• Strong coding ability, with Go and TypeScript a plus, and a record of building the tooling and automation that let one person cover a whole company
• Actively use LLMs and agents to find vulnerabilities and understand the risks AI introduces, while remaining fully capable at all tasks without AI assistance
• Experience building security from the ground up, ideally as a first or early security hire, with a pragmatic focus on real risk
• Clear written communicator on a distributed team, able to explain findings, business risk, and fixes to engineers and non-technical colleagues

Conditions

Fully remote role on a distributed team, reporting directly to the CTO

Hours and contract terms are not stated in the posting