Staff Security Engineer

Ambience Healthcare; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Ambience Healthcare in San Francisco seeks a Staff Security Engineer to own the security of our platform at scale. You’ll design secure-by-default patterns, own application, cloud security, detection and response, and lead cross-cutting security initiatives that enable enterprise trust and customer expansion.

You will collaborate with engineering to threat model new products, harden infrastructure, automate controls, and drive incident response.

Responsibilities

• Own systems that protect our platform across security domains and scale security posture.
• Design guardrails to make the secure path the default and harden our infrastructure against threats.
• Lead cross-cutting security initiatives that enable enterprise trust and customer expansion.
• Build secure-by-default patterns across our backend and infrastructure; identify and remediate vulnerabilities in APIs and data flows.
• Lead investigations, root cause analysis, and systemic fixes for detections and incidents.

Job description

• Ambience runs real-time clinical workflows inside the most security-sensitive health systems in the country
• That means security can’t be bolted on, it has to be engineered into the product
• As a Staff Security Engineer, you’ll own the systems that protect our platform at scale: application security, cloud security, detection and response, and the security primitives other teams build on
• You’ll design guardrails that make the secure path the default, harden our infrastructure against real threats, and partner with engineering to eliminate entire classes of risk
• This is a builder role. You’ll write code, design systems, and lead cross-cutting security initiatives that directly enable enterprise trust and customer expansion
• Application & Platform Security — Design and implement secure-by-default patterns across our backend and infrastructure. Identify and remediate vulnerabilities in application logic, APIs, and data flows
• Cloud & Infrastructure Security — Own security posture across our cloud environment: IAM, network boundaries, secrets management, and secure service-to-service communication
• Detection & Incident Response — Build and operate detection pipelines, alerts, and runbooks. Lead investigations, root cause analysis, and systemic fixes — not just one-off patches
• Security Tooling & Automation — Extend and integrate security tools through code. Automate controls, evidence collection, and remediation to reduce manual work and scale coverage
• Security Architecture & Leadership — Set technical direction for security across teams. Threat model new products, influence designs early, and raise the security bar company-wide