Senior Security Engineer at AIOS — Remote, $150k–$250k/yr inc equity

We’re at $450M ARR, growing from $7M/yr in April 2025. We’re faithfully serving 200k/mo patients via Bolt Pharmacy, our main UK brand. We’ve just launched Bolt Med, our international brand. We’re profitable.

Our strategy exists at the intersection of two strong theses:

1. The AI doctor that wins will get to escape velocity using GLP-1s, the fastest growing consumer product in history.

2. The $2T European healthcare market is overlooked by the most talented builders.

Our master plan:

You’ll own identity for everyone who needs access: single sign-on, MFA, conditional access, and the joiner, mover and leaver lifecycle.

You’ll own the fleet and the endpoint: device management, encryption, patching, lock and wipe when someone leaves, and endpoint detection and response from alert to containment.

You’ll own logging and detection. You’ll write detections that fire on real attacker behavior and automate the response, so when an alert fires at 3am, most of the work is already done. You’ll partner with engineering on cloud security, focused on identity and logging. AI agents and scripts handle the repeatable work so you can focus on judgment calls.

You’ll also run IT security: onboarding and offboarding for everyone, and the vendors and MSPs who handle day-to-day support.

Great performance in this role means every person and device that touches patient data is known and managed, the alerts that matter reach us fast, and any investigation can say exactly what happened.

This is a full-time, fully remote role, and you’ll work mostly async in the timezone of your choice — as long as you’re around until midday Pacific Time for calls as needed. You’ll have flex in your calendar for kids if you have them — many of our team have kids so we’re kid-friendly.

This is an individual contributor role. No management, you’ll be hands-on in the trenches. You’ll report directly to our Head of Information Security (Ryan Bentz). We’re intense, so you’ll also be intense.

You’ll also work most closely with our compliance and engineering leadership.

• →

  Identity: You own the identity provider and access model: SSO and SCIM, MFA policy, conditional and device-aware access, and joiner, mover and leaver for everyone who needs access.

• →

  Fleet: You own device management across the fleet: enrollment, encryption, patching, configuration baselines, and lock and wipe at offboarding.

• →

  EDR: You own EDR and work endpoint incidents from alert to containment.

• →

  Logging and detection: You decide what we collect, write and tune detections, and automate the response.

• →

  Cloud ownership: You work with engineering on cloud identity, logging and access.

• →

  Automation: You build the scripts and AI agents that take repeatable work off people.

• →

  IT operations: You own onboarding and offboarding end to end, from laptop and accounts on day one to full access removal on the last day. You manage the vendors and MSPs that handle parts of this work, hold them to a high bar, and automate the rest so it runs without a ticket. You’re the escalation point for IT issues across the team.

• →

  Incident response: You’re a first responder for security incidents.

• Experience: You have 6+ years in security engineering, with hands-on depth across identity, endpoint and detection.

• Identity: You’ve run an identity provider hands-on: SSO and SCIM, conditional access, and device-aware policies.

• Fleet: You’ve run MDM/UEM at scale, including enrollment, encryption and remote wipe.

• EDR: You’ve run an EDR and worked incidents from alert to containment.

• Detection engineering: You’ve written detections. You can describe one, what it caught, and how you tuned out the noise.

• Attacker mindset: You know how attacks work because you’ve done them: red teaming, pentesting, bug bounties, CTFs or similar.

• Automation: You script and automate (Python, bash, etc.) and already use AI agents to do more of your work.

• Cloud security: You know enough cloud security (AWS, GCP or Azure) to partner with engineers on identity, logging and access.

• IT and vendor management: You’ve owned onboarding, offboarding and IT operations for a distributed team, including managing outside vendors or MSPs and holding them to clear standards.

• Communication: You can explain risk clearly to employees, engineers and executives.

• Regulated experience: You’ve worked in healthcare or another regulated environment (HIPAA, GDPR, PCI).

• Hypergrowth: You’ve owned an identity or device program through fast growth.

• Distributed workforce: You’ve secured a distributed, multi-country workforce.

• Public work: You’ve shipped tools, detections, write-ups, talks or CVEs.

We aim to make this your life's work. This should be the most challenging, most rewarding role of your life. Accordingly, these are the core cultural standards to which we hold ourselves & our team-members:

1. Belief in the mission: We will have served 100 million patients by the end of 2030 and we transform the life of most patients who join. We have a lot of work to do. We are obsessed with our patients and are dedicated to the mission.

2. Unwavering integrity: We are at the frontier, so we often live in ambiguity with no trodden path. When we can't look to others for guidance, we must maintain impeccable ethics and unwavering integrity.

3. Only the paranoid survive: Bad sh*t is coming. By joining us, you're choosing to sail straight towards the storms with unhesitating conviction. However much we've already done, however far we've already come, it's still Day 1 and all our work is ahead of us.

4. If we're average we fail: We are only interested in "insanely great", a focus on the quality of our execution that in everyday life would be considered pathological. We have a dedication to excellence and reject incompetence.

5. Commitment to candor: That which can be destroyed by the truth should be. You get full transparency from the company and the company expects full transparency from you. We never say anything about someone that we wouldn't say to them directly. We give feedback with love and do not need to protect people from fleeting physical sensations.

6. A maniacal sense of urgency: We execute at an intensity that most people think is impossible. Speed is critical and we need things done yesterday. We all work very hard and in such a competitive world there really is no other way to win.

7. Enduring frugality: We are frugal. We hate being wasteful and we are anti-luxury. A culture of cheapness keeps us young. We spend our cash wisely & carefully, in a way that would make our grandmas proud.

8. Bulldozing barriers: The world is malleable and we shape it. We truly believe this and act accordingly. We are relentlessly resourceful and are at the mercy of no-one but ourselves. You'll be shocked how capable you are and how much you can achieve.

9. Keep your head down: We're boring people doing exciting work. We don't chase short-term status. We ignore short-term dopamine hits and focus on what matters. Outsiders will underestimate us and we revel in that.

10. The power of focus: We live in a world of power laws and we cannot overestimate the unimportance of practically everything. Know your One Thing, and nail it.

    
    🎯

"You just build a f\*ing amazing experience. Make each step amazing. Make every decision in the long term interest of the customer. Give the customer massively more value than you take."