Security Engineer

Aidoc is the market leader in healthcare AI and has developed the world's largest clinical frontier model, supporting nearly 50 million patients each year.

Aidoc is deployed in more than 2,000 medical centers worldwide. Since our founding in 2016, Aidoc has raised over $500 million and achieved a record number of FDA-cleared solutions.

Medical diagnosis is hitting a breaking point, where the number of physicians hasn't kept up with the rapidly growing patient load. This leads to misdiagnosis and treatment delays that result in hundreds of thousands of deaths every year. Aidoc assists clinicians by precisely highlighting diseases directly on medical images, preventing misdiagnosis and ensuring that urgent patients receive the immediate attention they need.

As a Senior Product Security Engineer, you will help ensure that security is built into the products, platforms, AI systems, and clinical workflows that support healthcare providers and patients at scale. This is a hands-on technical role focused on securing real systems in production, influencing architecture, and partnering closely with engineering, AI, DevOps, product, quality and regulatory.

You will work across cloud-native services, medical imaging workflows, healthcare integrations, AI/ML pipelines, APIs, data flows, and regulated product development processes. Your work will directly support Aidoc's ability to deliver secure, reliable, and trusted clinical AI solutions to healthcare organizations worldwide.

What Makes This Role Unique at Aidoc

- Clinical AI with real-world patient impact - Aidoc operates in an environment where security is not only about protecting systems and data. Security decisions can affect clinical workflows, care-team coordination, customer trust, and patient safety.

- Highly sensitive healthcare data - You will help protect medical imaging data, clinical metadata, PHI/PII, customer environments, and AI-driven workflows that require strong privacy, access control, data protection, and auditability.

- Security for AI/ML and medical imaging systems - The role extends beyond traditional AppSec into AI/ML security, data pipeline protection, inference integrity, model-related risks, and misuse scenarios in clinical workflows.

- Complex healthcare integrations - Aidoc integrates with hospital systems and healthcare workflows that may include PACS, EHR, VNA, RIS/worklists, scheduling systems, and communication platforms. You will help secure the data flows, authentication models, APIs, and deployment patterns behind these integrations.

- Engineering-driven security in a regulated environment - This is not a checkbox compliance role. However, because Aidoc operates in healthcare and clinical AI, security must be practical, evidence-based, and aligned with regulatory, customer, and quality expectations.

- Cloud-native scale and production ownership - You will work with modern cloud infrastructure, Kubernetes, containers, CI/CD pipelines, identity and access management, observability, vulnerability management, and software supply-chain controls.

• Secure product and clinical workflows end-to-end - Work directly with engineering and product teams to identify, prioritize, and remediate security risks across services, APIs, medical imaging workflows, AI outputs, data flows, and customer-facing product features.
• Drive secure-by-design architecture - Provide practical security guidance on authentication, authorization, tenant/customer isolation, encryption, secrets management, service-to-service communication, audit logging, and secure data handling.
• Strengthen cloud-native security - Improve security across cloud environments, Kubernetes, containers, IAM, network segmentation, workload identity, infrastructure-as-code, logging, monitoring, and cloud security posture management.
• Embed security into the development lifecycle - Integrate, tune, and operationalize security tooling across CI/CD pipelines, including SAST, SCA, IaC scanning, container scanning, secrets detection and build/release integrity controls.
• Own vulnerability management as an engineering system - Prioritize vulnerabilities based on exploitability, product exposure, customer impact, clinical risk, and regulatory relevance. Drive remediation with engineering teams and reduce recurring issues through root-cause improvements.
• Secure AI/ML-driven features and data pipelines - Partner with AI, data, and platform teams to identify risks related to training and inference data, model inputs and outputs, model misuse, data leakage, access to sensitive datasets, pipeline integrity, and production monitoring.
• Improve software supply-chain security - Reduce risk across open-source dependencies, third-party components, third-party algorithms, container images, build systems, artifact repositories, release pipelines, and deployment processes.
• Mentor and enable engineers - Help developers understand security risks, make secure design decisions, and take ownership of security in their code, services, and infrastructure.
• Communicate risk clearly - Translate technical security findings into clear risk, impact, and trade-off language for engineering, product, leadership, quality, regulatory, and customer-facing stakeholders.

• 5+ years of experience in Product Security, Application Security, Cloud Security, or a similar hands-on security engineering role.
• Strong hands-on experience securing production systems, not only performing assessments or reviews.
• Strong understanding of secure design, threat modeling, and architecture risk analysis.
• Deep knowledge of application security, including OWASP Top 10, API security, authentication, authorization, access control, secure session handling, input validation, and modern attack vectors.
• Experience securing distributed systems, APIs, web applications, backend services, and cloud-native architectures.
• Strong experience with cloud environments, especially AWS and/or Azure, including IAM, network security, encryption, logging, monitoring, and workload security.
• Experience with Kubernetes, containers, infrastructure-as-code, CI/CD pipelines, and modern DevOps workflows.
• Practical experience with security tooling such as SAST, SCA, IaC scanning, container scanning, secrets detection, SBOM tools, vulnerability scanners, and cloud security tools.
• Experience with vulnerability management, risk prioritization, remediation planning, and working with engineering teams to fix issues at scale.
• Strong understanding of software supply-chain security, including dependency risk, build/release integrity, artifact security, and third-party component governance.
• Experience working with modern development stacks such as Python, Java, JavaScript/TypeScript, React, microservices, APIs, and cloud-native services.
• Ability to influence engineers through technical credibility, practical guidance, and strong collaboration.
• Strong communication skills and the ability to explain security risks to technical and non-technical stakeholders.

Aidoc is deeply committed to creating an inclusive workplace, and to the principle of equal opportunity for all individuals. We prohibit discrimination and harassment based on race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by law.