Staff Security Engineer
Redox is on a mission to accelerate healthcare’s transformation with useful data. Redox Engine, a flexible interoperability platform, connects and powers real-time healthcare data exchange. With just one connection, data can be orchestrated across a growing network of 12,000+ systems and organizations, including 100+ electronic health record systems (EHRs). Redox processes over 1.2 billion messages per month across our health tech vendor, provider, payer, EHR, and life sciences customers.
Opportunity & Impact
We are seeking a Staff Security Engineer to take ownership of cloud-native and application security across the Redox platform. This is a high-impact, hands-on IC role where you will move beyond identifying risks to actively hardening our environment, performing code reviews, and translating complex control gaps into engineering proposals that drive production impact.
You will function as a partner to our Engineering teams, embedding security into the SDLC by default. Whether it is container security, Kubernetes hardening, or architecture design, you will have the autonomy to define our standards and ensure the secure path is always the easy path for every engineer on the team.
As a core member of a small, senior team, your technical decisions will scale across our entire network, directly impacting how we protect data for every customer we serve.
We're a fully remote team within the U.S. that operates with radical transparency and a strong bias toward ownership.
Our Engineering Culture & How We Work
Transparency, Ownership & Autonomy We make room for everyone to be heard, regardless of level. We work openly, normalize not knowing things, and treat "learning out loud" as a feature, not a liability. You'll be expected to bring your real perspective, push back when you see something wrong, and commit fully once a decision is made. As a Staff Engineer, you help cultivate our culture: you model the behavior, you embrace questions, you acknowledge mistakes.
We default to public Slack channels over DMs, post Zoom summaries back in writing, and work async whenever possible. We'd rather expose incomplete thinking in public to get better feedback than protect it in private. That applies to security work too - when you identify a risk or propose a control, you bring it to the table with a recommendation, not just a concern.
We own the systems we maintain, not just the new features on the roadmap. You'll have latitude to identify and drive platform work - defining scope, consulting on priority, and seeing it through from design to operationalization. We measure ourselves by the value we deliver, not the process we follow.
Job Responsibilities:
-
Own Cloud Security Posture Management including Kubernetes and Container security strategies, admission control, network policies, image integrity, and environment hardening.
-
Manage comprehensive vulnerability lifecycles, prioritizing remediation based on actual production exposure rather than simplistic finding metrics.
-
Collaborate with Platform Engineering to institutionalize secure SDLC and CI/CD safeguards, focusing on artifact validity and pipeline integrity.
-
Convert HITRUST and SOC 2 compliance frameworks into actionable technical configurations and operational controls.
-
Evaluate and secure infrastructure-as-code across all environments.
-
Execute incident response duties, encompassing forensic investigation and the facilitation of blameless post-mortem analyses.
-
Elevate security standards within Engineering through rigorous design reviews, collaborative pairing, and technical mentorship.
-
Oversee bug bounty triage and maintain professional engagement with external security researchers.
Required Skills & Experience:
-
8+ years in security engineering with a track record of Staff-level impact through system architecture, leadership of strategic initiatives, and technical mentorship.
-
Deep technical proficiency in Kubernetes security, specific