Product security engineer in telemedicine

We’re doxy.me (doc-see-me), the world's most loved telemedicine solution, and we're on a mission to connect the world to the future of healthcare. We believe that cost and complexity should never be a barrier to telemedicine. That’s why we created a simple, free, and secure telemedicine platform. We’re seeking a Staff Product Security Engineer who thrives on making an impact by being part of a team that ensures that Doxy.me is safe, secure, and compliant over time with industry standards for security, secure SDLC, and secure operating principles.

• Provide security leadership and guidance within our product engineering teams through developer-led threat modeling and education on security and privacy best practices that prevent the authoring of vulnerabilities.
• Coordinate security requirements and standards throughout the product life cycle by working closely with product engineering to manage the vulnerabilities, cryptography, security monitoring, and risk management controls within our application-based products.
• Participate in the development of Doxy.me’s DevSecOps security strategy and posture by designing, advocating and helping build secure-by-default CI/CD pipelines and processes
• Develop engineering reference implementations on topics of security patterns and security guardrails and how to implement these into software frameworks and the technology stack. Support and implement security technology and security control design proof of concepts and implementations
• Be a pioneering member of the Doxy.me Information Security Team; liaise with Product and Engineering teams to ensure all product business cases include functional security specs to ensure compliance with information security standards
• Track trends against various metrics that capture the risks, threats, and vulnerabilities within the product environment then prioritise and implement remediation activities for application flaws.

• A Bachelor's degree in computer science, programming, or related field and or equivalent job experience in lieu of a degree.
• Experience working with remote, globally distributed teams
• Experience working in organisations that develop software and/or operate managed infrastructure and technology services for their own customers
• AWS platforms or services (also consider equivalent experience in Azure or GCP)
• Kubernetes and container infrastructure
• Secure development and application of IAC solutions (Terraform, Helm)
• Experience with DevOps tools and processes, such as continuous integration and continuous deployment (CI/CD)
• Experience with security testing tools, such as static Code analysis and dynamic Application security testing (DAST)
• Strong understanding of OWASP Top 10, application security vulnerabilities and web security testing methodologies
• Understanding of secure coding practices for compliance requirements within SOC2, ISO, HIPAA, HITRUST, etc.
• Able to effectively give, receive, and respond to feedback
• Ability to educate company employees about security measures.
• Будет плюсом: Strong communication skills in English & Ukrainian are highly desirable for this position

• Условий в вакансии нет