Senior Security Engineer at AIOS — Remote, $150k–$250k/yr inc equity

📋 Job Overview

AIOS is building the world’s first full-stack AI doctor. We’re at $450M ARR, growing from $7M/yr in April 2025. We’re faithfully serving 200k/mo patients via Bolt Pharmacy, our main UK brand. We’ve just launched Bolt Med, our international brand. We’re profitable.

🏢 About AIOS

Our strategy exists at the intersection of two strong theses: The AI doctor that wins will get to escape velocity using GLP-1s, the fastest growing consumer product in history. The $2T European healthcare market is overlooked by the most talented builders.

Our master plan:

• Step 0 → $100M/yr by end of 2025: We went from $10M to $100M in 6 months serving the UK GLP-1 market.
• Step 1 → $1B ARR by end of 2026: Since April 2025 we've grown from 3k to 200k UK active GLP-1 patients. We’ll continue this growth curve to hit $1B ARR.
• Step 2 → $10B ARR by end of 2028: Blitzscale Europe. We’ll be Europe’s largest GLP-1 provider.
• Step 3 → $100B/yr by end of 2030: Get regulatory approval across Europe for our Full Autonomous Prescribing (FAP) system. Win contracts at scale with European payers to mass replace human labor. We’ll be the dominant full-stack AI doctor in Europe.
• Step 4 → $1T/yr by end of 2035: With one line of code and zero human time, you can use AIOS to treat any patient globally with any medication.

In so doing, we’ll become the world’s first trillion-dollar healthcare company. We’re a young, founder-led company. This is still Day 1 and all our work is ahead of us.

🎯 The Role

Being a Senior Security Engineer at AIOS, your fundamental role is to make sure we know who is on our systems, what they’re using, and exactly what happened when something goes wrong. You’ll own identity for everyone who needs access: single sign-on, MFA, conditional access, and the joiner, mover and leaver lifecycle. You’ll own the fleet and the endpoint: device management, encryption, patching, lock and wipe when someone leaves, and endpoint detection and response from alert to containment. You’ll own logging and detection. You’ll write detections that fire on real attacker behavior and automate the response, so when an alert fires at 3am, most of the work is already done. You’ll partner with engineering on cloud security, focused on identity and logging. AI agents and scripts handle the repeatable work so you can focus on judgment calls. You’ll also run IT security: onboarding and offboarding for everyone, and the vendors and MSPs who handle day-to-day support.

Great performance in this role means every person and device that touches patient data is known and managed, the alerts that matter reach us fast, and any investigation can say exactly what happened.

This is a full-time, fully remote role, and you’ll work mostly async in the timezone of your choice — as long as you’re around until midday Pacific Time for calls as needed. You’ll have flex in your calendar for kids if you have them — many of our team have kids so we’re kid-friendly. This is an individual contributor role. No management, you’ll be hands-on in the trenches. You’ll report directly to our Head of Information Security (Ryan Bentz). We’re intense, so you’ll also be intense. You’ll also work most closely with our compliance and engineering leadership.

✅ Key Responsibilities

• Identity: You own the identity provider and access model: SSO and SCIM, MFA policy, conditional and device-aware access, and joiner, mover and leaver for everyone who needs access.
• Fleet: You own device management across the fleet: enrollment, encryption, patching, configuration baselines, and lock and wipe at offboarding.
• EDR: You own EDR and work endpoint incidents from alert to containment.
• Logging and detection: You decide what we collect, write and tune detections, and automate the response.
• Cloud ownership: You work with engineering on cloud identity, logging and access.
• Automation: You build the scripts and AI agents that take repeatable work off people.
• IT operations: You own onboarding and offboarding end to end, from laptop and accounts on day one to full access removal on the last day. You manage the vendors and MSPs that handle parts of this work, hold them to a high bar, and automate the rest so it runs without a ticket. You’re the escalation point for IT issues across the team.
• Incident response: You’re a first responder for security incidents.

📌 Required Qualifications

• Experience: You have 6+ years in security engineering, with hands-on depth across identity, endpoint and detection.
• Identity: You’ve run an identity provider hands-on: SSO and SCIM, conditional access, and device-aware policies.
• Fleet: You’ve run MDM/UEM at scale, including enrollment, encryption and remote wipe.
• EDR: You’ve run an EDR and worked incidents from alert to containment.
• Detection engineering: You’ve written detections. You can describe one, what it caught, and how you tuned out the noise.
• Attacker mindset: You know how attacks work because you’ve done them: red teaming, pentesting, bug bounties, CTFs or similar.
• Automation: You script and automate (Python, bash, etc.) and already use AI agents to do more of your work.
• Cloud security: You know enough cloud security (AWS, GCP or Azure) to partner with engineers on identity, logging and access.
• IT and vendor management: You’ve owned onboarding, offboarding and IT operations for a distributed team, including managing outside vendors or MSPs and holding them to clear standards.
• Communication: You can explain risk clearly to employees, engineers and executives.

⭐ Desirable Experience

• Regulated experience: You’ve worked in healthcare or another regulated environment (HIPAA, GDPR, PCI).
• Hypergrowth: You’ve owned an identity or device program through fast growth.
• Distributed workforce:

🎁 Benefits

Salary: $150k–$250k/yr including equity.

🛂 Visa & Eligibility

Employment is contingent upon eligibility to work in the United States.