Staff Product Security Engineer

doxy.me

1d • Remote

About The Position

doxy.me is seeking a Staff Product Security Engineer to help turn its security team into an engineering team. This is a software engineering role focused on security: building and operating internal security platforms, governing the AI agents that work within them, and delivering product security for doxy.me’s telehealth platform. The successful candidate will be an early engineer on the team and will help shape the platforms and security function, taking problems from idea through production without requiring a detailed specification.

The role includes developing SecurityOS and the upcoming Trust Engine, including domain modules, integrations, event models, reporting, and console capabilities. It also involves building and governing AI agents, embedding with product teams to improve telehealth product security, and creating practical security tooling and automation that engineers use in their daily work. The position is remote-first, with regional hubs and an expectation that teams meet monthly in the London office.

Requirements

• Staff or principal-level capability.
• Ability to build and ship software, having taken a product or system from idea to production, maintained it, and supported other people depending on it, using TypeScript and Node or a comparable stack.
• Ability to design systems from the data model up and bring them into production.
• Substantial application and product security knowledge, including secure SDLC, threat modeling, secure design and code review, OWASP, and how vulnerabilities are introduced and prevented.
• Ability to take ambiguous problems from idea to working software without a specification or ticket.
• Experience building with AI and designing systems where agents are first-class actors with controls over their actions.
• Ability to work as a peer with product engineers and communicate security effectively to them.
• Bachelor’s degree in computer science or a related field, or equivalent experience.
• English-language communication skills; English is used for all internal communication.

Nice To Haves

• Experience building a platform, internal product, or developer tool from zero to adoption.
• Startup or founding experience, or a seriously developed and shipped side project.
• Healthcare, HIPAA, or other regulated-industry experience.
• Experience with AWS, Kubernetes, and infrastructure as code.
• Experience working with remote, globally distributed teams.

Responsibilities

• Design and build core SecurityOS capabilities, including domain modules, integrations with identity, endpoint, cloud, code, and ticketing systems, the platform event model, reporting, and the console layer.
• Build and maintain production software in TypeScript and Node for use by the security team.
• Build and govern AI agents, defining their capabilities, context, action controls, auditing, and access through the same front door as human users.
• Own product security for doxy.me’s telehealth platform as an embedded engineer, including threat modeling, design and code reviews, and implementing fixes or solutions.
• Build security tooling and guardrails as usable code for engineers rather than relying on policy documents.
• Automate the security SDLC, scaling threat modeling, design review, security code review, and security testing through platforms and automation.
• Shape the roadmap for SecurityOS and the way doxy.me’s security function operates.

Benefits

• Competitive salary.
• Unlimited PTO.
• Private medical, optical, and dental healthcare through AXA.
• 5% matched company pension.
• Remote working in a remote-dominant environment, with a flexible office workspace in London Liverpool Street and an expectation of monthly team meetings in the office.
• Company equipment, including a latest laptop, plus a £500 equipment spending allowance for equipment the employee can keep.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior