Senior Corporate Security Engineer - IT Security (x/f/m)

Doctolib; Paris; Sur place; EUR 110 000 - 150 000; Plein temps

Résumé du poste

Doctolib is seeking a Senior Corporate Security Engineer to join the SecOps team. You will own security programs end-to-end for identities, endpoints, SaaS apps, and a zero-trust network in a highly regulated healthcare environment.

You will ship every control as code using Terraform and GitHub PRs, drive cross-team adoption, and mentor junior engineers while continuously improving detection and response within Elastic SIEM.

Qualifications

• Built and enforced security controls in production (not only monitored alerts).
• Led end-to-end programs such as MFA rollout or device-compliance initiative.
• Experience with identity and access governance and modern authentication standards.

Responsabilités

• Own corporate security programs from architecture to enforcement: CA, phishing-resistant authentication, device compliance, SaaS and third-party app governance, and zero-trust network access.
• Ship changes as code using Terraform and GitHub PRs, with report-only to enforce rollout.
• Drive adoption across teams by writing proposals and aligning IT and business stakeholders.
• Evaluate and secure tools Doctolibers adopt; security reviews of SaaS integrations and AI tools.
• Lead incident investigations on the corporate perimeter end-to-end and improve SIEM rules.
• Mentor junior engineers and foster engineering excellence through peer review.

Connaissances

Security engineering

Security program ownership

Written communication

Decision making under uncertainty

English fluency

Outils

GitHub

Terraform

AI coding assistants

Description du poste

Set a new pulse for healthcare!We are looking for a Senior Corporate Security Engineer to join the Corporate Security team in SecOps.Your mission will be to secure everything Doctolibers rely on to do their best work identities, endpoints, SaaS applications, and the zero-trust network that connects them in a highly regulated healthcare environment (HDS, ISO 27001, C5) where security directly impacts patient safety and trust. You will own security programs end-to-end, shipping every control as code and driving adoption across teams, contributing directly to the protection of data for over 80 million patients and 400,000 health professionals.Working in the tech team at Doctolib means building innovative products and features to improve the daily lives of care teams and patients.

What you'll do

• Owncorporate security programs from architecture to enforcement: conditional access, phishing-resistant authentication, device compliance, SaaS and third-party app governance (including AI tools), and zero-trust network access.
• Ship every change as code: use Terraform and GitHub pull requests to bring controls to production designed, peer-reviewed, rolled out progressively (report-only → enforce), and always reversible.
• Drive adoption across teams: write technical proposals, align IT and business stakeholders, plan communications and exception handling, and land security controls without disrupting how people work.
• Evaluate and secure the tools Doctolibers adopt: conduct security reviews of SaaS integrations and AI tools, and deliver pragmatic, risk-based responses to shadow IT.
• Investigate and improve: lead incident investigations on the corporate perimeter end-to-end, and continuously improve detection rules and response playbooks in our Elastic SIEM.
• Mentor more junior engineers and contribute to a team culture of engineering excellence and peer review.

Who you are

Before you read on: if you don't have the exact profile described below, but you feel this job description matches your skill set, we still encourage you to apply.

You'll be a great fit if you:

• Have 5+ years of hands-on experience securing corporate/enterprise environments — identity, endpoints, SaaS, and network — including at least 2 years at a senior level. You have built and enforced security controls in production (not only monitored alerts), and owned at least one significant program end-to-end, such as an MFA rollout, a device-compliance initiative, or a SaaS access-governance project.
• Have strong daily mastery ofGitHub, Terraform, and AI coding assistants(Claude or equivalent). You ship security work as reviewed pull requests and use AI agents as a structural part of your workflow, not an occasional helper.
• Have deepidentity & accessexpertise: identity providers, conditional access policies, OAuth/application governance, and modern authentication standards (passkeys, phishing-resistant MFA).
• Have a pragmatic mindset, the ability to make decisions under uncertainty and follow through, andstrong written communication skills— you can carry a proposal from draft to cross-team adoption.
• Arefluent in English