Companies you'll love to work for

The Opportunity

The Product Security team at One Medical consults with and supports our Product team, which has developed a very large code base that comprises a full-featured Electronic Medical Records system called 1Life, as well as patient-facing applications. The Product Security team reviews architecture, design, and code, maintains security-related scanning in the CI/CD pipeline, and serves as expert consultants to engineers and product managers regarding all efforts to keep data safe. Typically, a Product Security Engineer meets with a number of Product teams on a regular cadence and keeps up with their work, intervening as appropriate to guide their security efforts.

The team itself is highly collaborative and is always sharing learning from its own team members, as well as teams that are adjacent to it in the security organization – those neighbor teams are our colleagues in Enterprise Security and Detection and Response. Product Security also interacts with our Technical Compliance group when they are reviewing our compliance with SOX, SOC 2, HIPAA, and other regulatory and compliance frameworks.

What you'll work on:

• Conduct hands-on security testing and code review of internally-developed applications
• Analyze security test results, document risks, and recommend mitigating controls
• Develop new security automation and tooling to improve our detection of and assist in the remediation of findings
• Provide product security guidance and architecture oversight, design reviews and security feature roadmap collaboration
• Provide security subject matter expertise to development teams, developing secure coding practices, and develop hands-on training to developers and quality engineers
• Participate in our incident response and vulnerability remediation efforts
• Security research, presentation, and security industry collaboration

You’ll need (role level):

• 2+ years of product/application security experience
• Experience providing security recommendations to developers including design/code reviews and threat modeling
• Experience with providing security recommendation and guidance in at least two of the following languages/frameworks: Ruby on Rails, Python, GoLang, Javascript, React, Angular, Swift, Kotlin, C, C++
• Working experience identifying, testing, and remediating against vulnerabilities including those found in the OWASP Top 10 and CWE/SANS Top 25
• Experience building automation and/or writing scripts to solve security problems
• Working knowledge of the browser security model, cryptography, and network security
• B.S. / M.S. in Computer Science, Electrical Engineering, or equivalent experience

Nice to Have:

• OSCP, OSWE, GPEN or similar certifications
• Experience working in highly regulated environments subject to compliance requirements such as HIPAA, HITrust, PCI
• Experience with authentication/authorization technologies, like OpenID Connect, JWTs, SAML, and HMACs
• Experience with mobile security reviews and testing
• Contributions to the security community such as research, public CVEs, bug-bounty recognitions, open-source projects, and blogs or publications
• Dual Builder / Breaker mindset: Passion for breaking things and working alongside teams to fix them
• Good sense of humor :)

Benefits designed to aid your health and wellness:

Taking care of you today

• Paid sabbatical after 5 and 10 years
• Employee Assistance Program - Free confidential advice for team members who need help with stress, anxiety, financial planning, and legal issues
• Competitive Medical, Dental and Vision plans
• Free One Medical memberships for yourself, your friends and family
• Pre-Tax commuter benefits
• PTO cash outs - Option to cash out up to 40 accrued hours per year

Protecting your future for you and your family

• 401K match
• Opportunity to participate in company equity programs
• Credit towards emergency childcare
• Company paid maternity and paternity leave
• Paid Life Insurance - One Medical pays 100% of the cost of Basic Life Insurance
• Disability insurance - One Medical pays 100% of the cost of Short Term and Long Term Disability Insurance

This is a full-time role based anywhere in the United States.

The base salary range for this role is $106,000 to $204,000. However, actual compensation packages are based on several factors that are unique to each candidate. These factors include, but are not limited to, job related knowledge and skill set, depth of experience, certifications and/or degrees, and specific work location. The total compensation package for certain roles may also include additional components such as a sign-on bonus, annual performance bonus, equity grants in the form of RSUs, medical and other benefits and/or other applicable incentive compensation plans.

#LI-DNI