Doximity: Senior Security Engineer, DevOps

Why work at Doximity?

Doximity is the leading social network for healthcare professionals with over 70% of U.S. doctors as members. We have strong revenues, real market traction, and we’re putting a dent in the inefficiencies of our $2.5 trillion U.S. healthcare system. After the iPhone, Doximity is the fastest adopted product by doctors of all time. Our founder, Jeff Tangney, is the founder & former President and COO of Epocrates (IPO in 2010), and Nate Gross is the founder of digital health accelerator RockHealth. Our investors include top venture capital firms who’ve invested in Box, Salesforce, Skype, SpaceX, Tesla Motors, Twitter, Tumblr, Mulesoft, and Yammer. Our beautiful offices are located in SoMa San Francisco.

This position is for an experienced DevOps engineer, to own Security efforts for our entire application stack, to join our 8 person DevOps team. We’re looking for someone with a strong track record in building infrastructure, maintaining high level of uptime and optimal security. You will be supporting and building products alongside our 50+ person engineering team used by hundreds of thousands of people.

Skills & Requirements

-Minimum of 5 years of Linux/UNIX systems engineer & administrator experience.

-Minimum of 5 years of relevant web application security experience

-Extensive AWS experience

-Experience writing application security penetration tests with an open source framework.

-Automation experience with configuration management tools such as Chef, Ansible, or Puppet.

-Intermediate to advanced experience administering and securing an RDB (MySQL or Postgres a plus)

-Proficient in bash shell scripting (sed + awk) and one of Ruby or Python.

-Experience automating application deployments with Capistrano or Jenkins.

-Ability to work in a proactive manner and manage your own queue.

-Experience with Hashicorp tools, Neo4j, Elasticsearch, Kibana, Grafana is a big plus.

Typical Tasks

-Develop, schedule, and execute automated security audits on infrastructure using industry standard security frameworks and tooling.

-Write penetration tests for applications and services.

-Periodically audit and rotate access credentials.

-Document current and future security procedures and policies in the wiki.

-Lead security/policy related audits such as SOC2 Type II (annual renewal).

-Work with sales and client services teams to answer infrastructure related security questions and concerns that clients inquire about.

-Remediate and write post-mortem reports on security-related issues.

-Active involvement in design, implementation, and maintenance of the development, staging, and production infrastructure security.

-Work on automating tasks using Jenkins.

-Troubleshoot system issues (such as high-load, memory, CPU usage, etc.) and come up with temporary/long-term solutions based on the root cause.

-Work with developers to deploy applications ready for production (Terraform, Consul, Vault, Upstart, NGINX, Sensu). We believe in infrastructure as code and follow it.

-Write Chef cookbooks (using “Berkshelf Way”) to automate configuration management.

-Participate in a 1-week on 7-week off, 24/7 on-call rotation.

-Hands-on maintenance on our Ruby on Rails and Go (Golang) applications.

-Troubleshoot issues across the whole stack: hardware, software, and network.

A few facts about us

-We deploy our applications to production on average 25 times per day.

-We have over 250 private repositories in Github, ranging from forks of gems, our own internal gems as well as auxiliary applications.

-Our production stack is hosted on AWS and QA clusters on DigitalOcean.

-Hundreds of thousands of healthcare professionals will utilize the products you build.

-We host unstructured “hack days” periodically, which is time reserved for you to scratch a code itch.

-A couple times a year we run a co-op where you can pick a few people you’d like to work with and drive a specific company goal.

-Every new engineer ships code to production on day one. Our mentorship program ensures you’re immersed in the team’s culture early on. 

About the Technical Stack