[Hiring] Senior Security Engineer @AgelessRx

Role Description

AgelessRx is seeking a hands-on, highly capable Senior Security Engineer to serve as the technical owner of information security across our growing telehealth environment. As a healthcare company, protected health information (PHI) flows through much of what we build and operate, making security, privacy, and regulatory compliance fundamental to our products, infrastructure, and internal systems.

This is a broad security engineering role with meaningful ownership across:

• Application and product security
• Cloud infrastructure
• Identity and access management
• Vulnerability management
• Security operations
• Technical security governance

The Senior Security Engineer will also serve as a key technical partner in AgelessRx's approach to AI security and governance. This person will help ensure AI tools and systems are deployed responsibly, securely, and in accordance with AgelessRx's obligations as a healthcare organization.

This is not a compliance-only role. We are looking for someone who can move comfortably between strategy and execution:

• Reviewing a sensitive code path or investigating a vulnerability one day
• Establishing an access-control standard or evaluating an AI vendor the next
• Translating technical and regulatory risk into clear recommendations for leadership

Qualifications

• 5+ years of experience in security engineering, cybersecurity, or a related technical security role.
• Hands-on depth across at least two major security domains, such as application/product security, cloud and identity security, vulnerability management, security operations, or security governance.
• Experience securing environments subject to HIPAA or comparable regulatory requirements and translating regulatory obligations into technical controls.
• Strong working knowledge of at least one major cloud provider and associated IAM and security practices.
• Strong understanding of identity and access management, including SSO, SAML/OIDC, MFA, privileged access, and least-privilege principles.
• Experience with application-security tooling and practices, including SAST, SCA, dependency management, threat modeling, and secure software development.
• Experience establishing or operating recurring security programs such as vulnerability management, access reviews, penetration testing, security assessments, or incident-response exercises.
• Experience assessing and prioritizing vulnerabilities based on exploitability, business impact, sensitive-data exposure, and practical risk - not simply severity scores.
• Working understanding of AI/LLM security risks and the challenges associated with governing AI systems in regulated environments.
• Strong written communication and documentation skills, particularly for audiences that may include engineers, executives, auditors, regulators, and non-technical stakeholders.
• Ability to operate autonomously and establish structure in an environment where security processes and infrastructure are still evolving.

Requirements

• Direct experience conducting HIPAA Security Rule risk analyses, preparing for OCR audits, or supporting healthcare security investigations or breach response.
• Experience securing healthcare technology, telehealth platforms, EHR integrations, or HL7/FHIR-based systems.
• Experience building or significantly maturing a security program as an early or first dedicated security hire.
• Experience implementing AI governance or AI risk-management programs, including familiarity with NIST AI RMF, ISO/IEC 42001, or similar frameworks.
• Experience evaluating AI vendors or systems that process PHI or other regulated data.
• Familiarity with emerging healthcare and AI regulatory requirements.
• Experience with containerization platforms such as Docker.
• Relevant security certifications such as OSCP, HCISPP, CISSP, or cloud-security certifications are valued but not required.