Information Security Engineer

📋 Job Overview

Information Security Engineer
Where Medicine Meets Intelligence
Doctronic is the first AI legally authorized to practice medicine. We're processing millions of consultations monthly with 99%+ treatment plan accuracy validated by board-certified clinicians.

🏢 About Doctronic

We're looking for an Information Security Engineer to own our security posture. We're HIPAA-compliant and SOC 2 Type II certified—you'll maintain and strengthen that foundation as we scale to serve millions of patients and enterprise partners.

🎯 The Role

This role is critical to our mission. When you're protecting healthcare data, security isn't just best practice—it's a sacred responsibility. You'll combine hands-on technical work with strategic security leadership, ensuring Doctronic remains the most trusted AI diagnostic platform in healthcare.

✅ Key Responsibilities

• Maintain SOC 2 Type II compliance and manage ongoing audits with external assessors
• Implement and monitor HIPAA technical safeguards across our infrastructure and applications
• Conduct and coordinate regular penetration testing, vulnerability assessments, and security reviews
• Complete vendor security reviews and respond to enterprise security questionnaires from health systems and payers
• Implement and enforce security policies across engineering, operations, and business teams
• Respond to security incidents with urgency and thoroughness, conducting post-incident analysis
• Build security automation and monitoring to scale protection as the company grows
• Collaborate with engineering teams to embed security best practices into the development lifecycle
• Stay current on emerging threats, vulnerabilities, and regulatory requirements in healthcare technology

📌 Required Qualifications

• 7+ years of information security experience in production environments
• Healthcare or fintech background required—you understand regulated industry security requirements
• Hands-on technical ability, not just policy and paperwork—you can read code, configure systems, and investigate incidents
• Deep experience with SOC 2, HIPAA, or equivalent compliance frameworks
• Familiarity with AWS security controls, IAM, encryption, and cloud security best practices
• Strong communicator who can translate security requirements for technical and non-technical audiences
• Proactive problem-solver who anticipates risks before they materialize
• Collaborative partner who enables teams to move fast while staying secure

⭐ Desirable Experience

• CISSP, CISM, CISA, or equivalent security certification
• Experience with health information exchanges, TEFCA, QHIN, or interoperability standards
• Startup security experience—building security programs from scratch vs. maintaining established ones
• Familiarity with AI/ML security considerations and model protection
• Experience with mobile app security (iOS/Android)
• Knowledge of medical device security standards or FDA digital health guidance
• Background in application security, secure SDLC, or DevSecOps

🎁 Benefits

Base Salary: $180K-$240K + Equity
Parental Leave: 12 weeks fully paid parental leave for all parents, regardless of gender or path to parenthood — no distinction between birthing and non-birthing parent

🛂 Visa & Eligibility

Reports To: Director of Engineering