Product security engineer

doxy.me; Greater London; Remote; GBP 90,000 - 150,000; Full time

Benefits offered by this job

Unlimited PTO

Private medical, optical and dental健康

5% matched company pension

Remote working with occasional London,

Company equipment + £500 spending on a

Job summary

doxy.me is seeking a senior security-focused software engineer to own SecurityOS for its telemedicine platform. You will design and code secure features, govern AI agents, and collaborate with product teams to embed security by default across the stack.

You will drive threat modeling, secure design, and manual/automated security testing, shaping the roadmap for security engineering and tooling. A remote-dominant role with occasional London presence supports global distributed teams.

Qualifications

• Solid production experience with TypeScript/Node.js.
• Deep knowledge of secure SDLC, threat modeling, and code review.
• Experience with AI-enabled platforms and agent-based systems.

Responsibilities

• Design and build core SecurityOS capabilities for doxy.me platform.
• Build and govern AI agents within the platform ensuring controls/audits.
• Own product security through threat modeling, design/code reviews, and implementation when needed.
• Develop security tooling and guardrails to automate SDLC at scale.

Skills

TypeScript

Node.js

Application security

Threat modeling

Secure SDLC

Code review

AI integration

Cross-functional collaboration

Education

Bachelor's degree in Computer Science or related field

Equivalent experience

Tools

AWS

Kubernetes

Infrastructure as Code

Job description

Описание

We’re doxy.me (doc-see-me), the world's most loved telemedicine solution, and we're on a mission to connect the world to the future of healthcare. This is a software engineering role with security as the domain, not a security role with some scripting attached.

Задачи

Design and build core SecurityOS capabilities: domain modules, integrations with the systems that feed the platform (identity, endpoints, cloud, code, ticketing), the event model that connects them, and the reporting and console layer on top. Build and govern AI agents that operate inside the platform: define what they can do, what context they get, how their actions are controlled and audited, and how they go through the same front door as a human user. Own product security for doxy.me's telehealth platform as an embedded engineer: threat modeling with product teams, design and code review, and fixing or building the thing yourself when that is the fastest path. Build the security tooling and guardrails that make the right thing the default in our stack, as code our engineers actually use, not as policy documents. Automate the security SDLC. You know how to threat model, review a design, review code for security flaws, and run security testing by hand. Your job is to build the platform and automation that does that work at scale, so it is not done by hand. Shape the roadmap. You will have real influence over what SecurityOS becomes and how the security function at doxy.me operates.

Требования

You can build and ship software. You have taken something from an idea to running in production, maintained it, and had other people depend on it, in TypeScript and Node or a comparable stack. You have real depth in application and product security: secure SDLC, threat modeling, secure design and code review, OWASP and how vulnerabilities actually get authored and designed out. You have built things nobody asked you to build because you saw they were needed, and they got used. You can take an ambiguous problem, form a point of view, and drive it to working software without a spec or a ticket. You have opinions about how a security program should run and you are not attached to the way it has always been done. You are comfortable building with and around AI: using it as a core part of how you work, and designing systems where agents are first-class actors with controls on what they can do. You can talk to product engineers as a peer. They should see you as one of them who happens to know security deeply. Staff or principal level expected. Years matter less than what you have built and what you can show us. Bachelor's degree in computer science or a related field, or equivalent experience. A strong portfolio of shipped work counts for more than the degree. Experience with remote, globally distributed teams. English is the language of all internal communication.

• Будет плюсом: Experience building a platform, internal product, or developer tool from zero to adopted; Startup or founding experience, or a side project you took seriously enough to ship; Healthcare, HIPAA, or other regulated-industry context; AWS, Kubernetes, and infrastructure as code. Useful, but we are not hiring for this

Условия

• Unlimited PTO
• Private medical, optical and dental healthcare through AXA
• 5% matched company pension
• Remote working - we have recently secured a small flexible office workspace in London Liverpool Street (here). Our current expectations are for teams to meet once per month in office; we would still anticipate a remote dominant environment going forward
• Company equipment (inc. latest laptop) + £500 spending allowance on equipment you can keep