Product security engineer

We’re doxy.me (doc-see-me), the world's most loved telemedicine solution, and we're on a mission to connect the world to the future of healthcare. This is a software engineering role with security as the domain, not a security role with some scripting attached.

• Design and build core SecurityOS capabilities: domain modules, integrations with the systems that feed the platform (identity, endpoints, cloud, code, ticketing), the event model that connects them, and the reporting and console layer on top.
• Build and govern AI agents that operate inside the platform: define what they can do, what context they get, how their actions are controlled and audited, and how they go through the same front door as a human user.
• Own product security for doxy.me's telehealth platform as an embedded engineer: threat modeling with product teams, design and code review, and fixing or building the thing yourself when that is the fastest path.
• Build the security tooling and guardrails that make the right thing the default in our stack, as code our engineers actually use, not as policy documents.
• Automate the security SDLC. You know how to threat model, review a design, review code for security flaws, and run security testing by hand. Your job is to build the platform and automation that does that work at scale, so it is not done by hand.
• Shape the roadmap. You will have real influence over what SecurityOS becomes and how the security function at doxy.me operates.

• You can build and ship software. You have taken something from an idea to running in production, maintained it, and had other people depend on it, in TypeScript and Node or a comparable stack.
• You have real depth in application and product security: secure SDLC, threat modeling, secure design and code review, OWASP and how vulnerabilities actually get authored and designed out.
• You have built things nobody asked you to build because you saw they were needed, and they got used.
• You can take an ambiguous problem, form a point of view, and drive it to working software without a spec or a ticket.
• You have opinions about how a security program should run and you are not attached to the way it has always been done.
• You are comfortable building with and around AI: using it as a core part of how you work, and designing systems where agents are first-class actors with controls on what they can do.
• You can talk to product engineers as a peer. They should see you as one of them who happens to know security deeply.
• Staff or principal level expected. Years matter less than what you have built and what you can show us.
• Bachelor's degree in computer science or a related field, or equivalent experience. A strong portfolio of shipped work counts for more than the degree.
• Experience with remote, globally distributed teams. English is the language of all internal communication.
• Будет плюсом: Experience building a platform, internal product, or developer tool from zero to adopted; Startup or founding experience, or a side project you took seriously enough to ship; Healthcare, HIPAA, or other regulated-industry context; AWS, Kubernetes, and infrastructure as code. Useful, but we are not hiring for this

• Unlimited PTO
• Private medical, optical and dental healthcare through AXA
• 5% matched company pension
• Remote working - we have recently secured a small flexible office workspace in London Liverpool Street (here). Our current expectations are for teams to meet once per month in office; we would still anticipate a remote dominant environment going forward
• Company equipment (inc. latest laptop) + £500 spending allowance on equipment you can keep