Senior Security Engineer
First dedicated security engineer at Spruce Health, a cloud healthcare communications platform. Owns security end to end — application/infra, endpoints and MDM for a remote Mac fleet, corporate IT, and AI tooling — including pen-testing, AWS hardening, incident response, and SOC 2/HIPAA compliance.
- Compensation
- $200K–$225K / yr
- Location
- San Francisco
- Work setup
- Remote
- Seniority
- Senior
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- 8+ years in security engineering, including owning security at a distributed software company
- Broad experience across application, cloud (AWS), and corporate security, with depth in at least one
- Hands-on experience running MDM and endpoint security for a remote macOS fleet
- Proven offensive skills: penetration testing, red teaming, and social engineering
- Writes solid code (Go and TypeScript a plus) and builds security tooling and automation
- Actively uses LLMs and agents to find vulnerabilities and understands AI-introduced risks, while strong without AI
- Clear written communicator for a distributed team, able to explain findings and risk to technical and non-technical colleagues
Nice to have
- Experience in healthcare or another regulated (SOC 2, HIPAA) environment
- Experience as a first or early security hire building security from the ground up
Full description
Compensation: $200k – $225k
About the Company
Spruce is a cloud-based healthcare communications platform that powers clinical workflows for both in-person and remote care. Since launching in 2016, we've grown to support more than 50,000 healthcare professionals working in practices of every size, from solo practices to large multi-site, multi-specialty groups.
Our platform spans telemedicine, telephony, secure messaging, team collaboration, and workflow automation. Spruce is widely used and loved by small- to medium-sized medical practices across the United States, with a 4.9+ rating across 100K+ reviews.
About the role
This is a foundational role: the first engineer at Spruce whose only job will be security. You'll join our fully remote, tight-knit, and lean engineering team, report directly to our CTO, and lead security across every entry point: our application and infrastructure, our people, our IT systems, and our employees' devices.
Everyone at Spruce stays responsible for security, and you'll make it easier for them to do it well. You'll build on what's already in place: taking ownership of work that's been shared across the team, driving concrete projects forward, and shaping how we discuss and prioritize security as we grow. As our in-house security expert, you'll advise teammates when they want to connect an AI agent to a new system, bring on a new vendor, ship a sensitive feature, or handle an unusual support request.
A bit about our stack: our backend is written in Go, as services that interact via gRPC, and our client-facing APIs are specified in GraphQL. Our web and desktop apps are written in TypeScript and React, running in the browser and as an Electron app. Our mobile apps are native: Swift and Objective-C on iOS, and Kotlin and Java on Android. We use Terraform to manage our infrastructure on AWS. Beyond engineering, we're a fully remote company on Mac endpoints, with internal tools accessed over a VPN.
The systems you'll protect operate in a high-reliability healthcare environment where correctness, security, and uptime are critical, and where your decisions protect clinical workflows and customer data.
You’ll feel at home here if you measure success by risks actually closed, and if no task is beneath you when it gets the issue resolved.
Key Responsibilities
- Build and own Spruce's security roadmap across every entry point, prioritized by risk and feasibility, and track progress over time
- Secure AI across Spruce, from the tools and agents we use to the AI features we ship
- Own endpoint security and MDM for our remote team, keeping machines with access to sensitive internal tools locked down without slowing people down