Help us build meaningful software in healthcare used by doctors, patients, and researchers worldwide.

Our Company
Doxy.me is the simple, free, and secure telemedicine solution used by over 700,000 healthcare providers worldwide. Our mission is to eliminate barriers to telemedicine like cost and accessibility, so we are constantly striving to make doxy.me more accessible to everyone, everywhere. With over 500,000 telemedicine calls made through our platform every day, there are millions of people relying on us to simplify their healthcare services.

Our Culture

Collaborative. We have multiple cross-functional teams that work together to make our platform the best it can be. Our engineers enjoy being involved in identifying problems and exploring potential solutions.
Empathetic. We listen to and strive to understand the patients and providers that depend on our work. Millions of people depend on our products to solve their very real health problems every day!
Empowering. We are building products, where your ideas and expertise can help revolutionize the healthcare industry. We encourage our engineers to spearhead projects and ideas. Our employees have the power to create change!

Overview
We are looking for an Application Security Engineer motivated by unique, interesting, meaningful challenges in the healthcare sector. What you will do affects hundreds of thousands doctors and patients every single day. You will perform important day-to-day activities in the application platform security area that ensure that doxy.me’s code is secure and controls are operating efficiently and effectively. You will be partnering with the Development and Security teams to ensure our product is safe from malicious activity, vulnerabilities and accidental disclosure. This role will help build and advise on the systems and frameworks we use to keep the product safe. We're focused on secure-by-design frameworks, least privilege access, detection and alerting, and eliminating bugs.

What Will You Do

Serve as the subject matter expert for application security, providing guidance to Development, SRE, Security and Product teams
Design and implement SSDLC practices including secure code reviews, static/dynamic code analysis, and vulnerability assessments
Raise security awareness by pointing out potential security vulnerabilities and their potential impacts, during code reviews
Implement continuous monitoring systems and tools to automatically identify potential security issues at the code, application and infrastructure layers
Drive security improvements to production cloud environments

Our Expectations

Ability to dissect new systems, product requirements, features to identify and develop security requirements
Expertise in secure coding and performing automated or manual static analysis (Javascript)
Hands-on experience in conducting penetration testing and vulnerability assessment
Hands-on experience in configuring and hardening cloud-based infrastructure (AWS preferable)
Familiar with Agile software development methodologies, DevOps practices and tools
Working experience with application security tools such as vulnerability scanners, SAST/DAST/IAST, Checkmarx. Snyk, Veracode or SonarQube
Knowledge of OWASP Top Ten, NIST, Mitre ATT&ck Framework., etc.
Good to have, but not required: security certifications such as OSCP, CEH, GWAPT, etc

Quick Info

Benefits: 20 days paid time off, sick leave, flexible public holidays, extensive educational program, health insurance, office hub in Kyiv (Podil), remote working environment
Doxy.me tech stack:
- React, Node.js, Typescript, WebRTC, Loopback 4, AWS, Kubernetes, Docker, AngularJS
- 3rd party: Tokbox, Pubnub, Segment, Twilio, Stripe
Our products:
- Doxy.me: The simple, free, and secure telemedicine solution currently used by over 700000 doctors worldwide and helping over 500000 patients/day.
- dokbot.io: Patient-focused data collection for healthcare.
- ItRunsInMyFamily.com: Using health history to identify the risks of cancer and other diseases that run in families
Our team: technologists, academics, researchers, and innovators from all over the world. English is the language used in all internal communication.
To ensure HIPAA compliance we perform background checks after extending a job offer.

Doxy.me

New Jobs

Application Security Engineer (Javascript/node.js/React)