About this role
Staff Product Security Engineer
Who we are
We’re doxy.me (doc-see-me), the world's most loved telemedicine solution, and we're on a mission to connect the world to the future of healthcare.
We believe that cost and complexity should never be a barrier to telemedicine. That’s why we created a simple, free, and secure telemedicine platform. Since 2013, we’ve grown to more than 1 million healthcare providers from 180+ countries who have clocked over 8 billion minutes of telemedicine sessions to date.
Our goal is to deliver the future of healthcare to every patient and healthcare professional on earth. Help us get there by joining our team of innovators, dreamers, and doers.
We’re a remote-first company with regional hubs for in-person collaboration (Charleston, SC, Salt Lake City, UT & London, UK).
The role
This is a software engineering role with security as the domain, not a security role with some scripting attached.
We are building internal security platforms, such as SecurityOS and our Trust Engine, that run the security program for our product, with AI doing much of the work that used to be manual. SecurityOS is in production today, Trust Engine is next, and there is more to come.
The security team at doxy.me is becoming an engineering team. We build and run these platforms, we build and govern the AI agents that operate inside them, and we ship the product security work for doxy.me's telehealth platform as part of the same practice. You would be an early engineer on that team with a direct hand in what these platforms become.
We are looking for someone with a founder mindset: you see what should exist, you design it, you build it, and you ship it. You can own a problem end to end without a spec handed to you. You have taste about what makes software good and opinions about how security should be done, and you can back both with working code.
What you'll build and do
- Design and build core SecurityOS capabilities: domain modules, integrations with the systems that feed the platform (identity, endpoints, cloud, code, ticketing), the event model that connects them, and the reporting and console layer on top. Production TypeScript and Node, shipped to real users on the security team.
- Build and govern AI agents that operate inside the platform: define what they can do, what context they get, how their actions are controlled and audited, and how they go through the same front door as a human user.
- Own product security for doxy.me's telehealth platform as an embedded engineer: threat modeling with product teams, design and code review, and fixing or building the thing yourself when that is the fastest path.
- Build the security tooling and guardrails that make the right thing the default in our stack, as code our engineers actually use, not as policy documents.
- Automate the security SDLC. You know how to threat model, review a design, review code for security flaws, and run security testing by hand. Your job is to build the platform and automation that does that work at scale, so it is not done by hand.
- Shape the roadmap. You will have real influence over what SecurityOS becomes and how the security function at doxy.me operates.
Who you are
Must-haves
- You can build and ship software. You have taken something from an idea to running in production, maintained it, and had other people depend on it, in TypeScript and Node or a comparable stack. We care that you can design a system from the data model up and get it live, not how many years you have been doing it. If AI tools are a big part of how you build, good. That is how we build too.
- You have real depth in application and product security: secure SDLC, threat modeling, secure design and code review, OWASP and how vulnerabilities actually get authored and designed out. You need this to be able to build software that does it. Knowing it is table stakes; building it is the job.
- You have built things nobody asked you to build because you saw they were needed, and they got used.
- You can take an ambiguous problem, form a point of view, and drive it to working software without a spec or a ticket.
- You have opinions about how a security program should run and you are not attached to the way it has always been done.
- You are comfortable building with and around AI: using it as a core part of how you work, and designing systems where agents are first-class actors with controls on what they can do.
- You can talk to product engineers as a peer. They should see you as one of them who happens to know security deeply.
Nice-to-haves
- Experience building a platform, internal product, or developer tool from zero to adopted.
- Startup or founding experience, or a side project you took seriously enough to ship.
- Healthcare, HIPAA, or other regulated-industry context.
- AWS, Kubernetes, and infrastructure as code. Useful, but we are not hiring for this.
Your skills
- Staff or principal level expected. Years matter less than what you have built and what you can show us.
- Bachelor's degree in computer science or a related field, or equivalent experience. A strong portfolio of shipped work counts for more than the degree.
- Experience with remote, globally distributed teams. English is the language of all internal communication.
What we can offer you
We have been evolving our benefits since launching in the UK in 2023; we’re continually seeking employee feedback to ensure they deliver real value to everyone and, as such, the below is not a finite, exhaustive list. Alongside a competitive salary, we also offer;
- Unlimited PTO
- Private medical, optical and dental healthcare through AXA
- 5% matched company pension
- Remote working - we have recently secured a small flexible office workspace in London Liverpool Street ( here (https://maps.app.goo.gl/6jiudYKVF5Q5Jk4m7) ). Our current expectations are for teams to meet once per month in office; we would still anticipate a remote dominant environment going forward
- Company equipment (inc. latest laptop) + £500 spending allowance on equipment you can keep
Interview process
- 1st stage - Chat with our internal recruiter
- 2nd stage - Hiring manager interview with the VP, Security and Privacy
- 3rd stage - Team Interview
- 4th stage - Build exercise: a small, real problem from SecurityOS. We want to see how you think and what you ship, not whether you can answer trivia.
- 5th stage - Meet our VP of Engineering
If you have something you built that you are proud of, bring it. A repo, a demo, a product. That will tell us more than a resume.
Additional information
- Doxy.me (http://doxy.me/) tech stack
Frontend: React, TypeScript, Playwright, WebRTC, Next.js, Nx.dev (http://nx.dev/)
- Backend: Nodejs, TypeScript, Jest, NestJS, Nx.dev (http://nx.dev/)
- Cloud: AWS
- 3rd party: Vonage, Segment, Twilio, Stripe
- Our products:
Doxy.me (http://doxy.me/) : The simple, free, and secure telemedicine solution currently used by over 1,000,000 doctors worldwide and helping over 350,000 patients/day.
- dokbot.io (http://dokbot.io/) : Patient-focused data collection for healthcare.
- adhere.ly (https://adhere.ly/) : Providing healthcare practitioners with the tools to ensure patients complete their course of treatment
- Our team: technologists, academics, researchers, and innovators from all over the world. English is the language used in all internal communication.
- To ensure HIPAA compliance we perform background checks after extending a job offer