Senior Security Engineer at AIOS — Remote, $150k–$250k/yr inc equity

About AIOS

AIOS is building the world’s first full-stack AI doctor.

We’re at $450M ARR, growing from $7M/yr in April 2025. We’re faithfully serving 200k/mo patients via Bolt Pharmacy, our main UK brand. We’ve just launched Bolt Med, our international brand. We’re profitable.

Our strategy exists at the intersection of two strong theses:

• The AI doctor that wins will get to escape velocity using GLP-1s, the fastest growing consumer product in history.

• The $2T European healthcare market is overlooked by the most talented builders.

Our master plan:

• Step 0 → $100M/yr by end of 2025 : We went from $10M to $100M in 6 months serving the UK GLP-1 market.

• Step 1 → $1B ARR by end of 2026 : Since April 2025 we've grown from 3k to 200k UK active GLP-1 patients. We’ll continue this growth curve to hit $1B ARR.

• Step 2 → $10B ARR by end of 2028 : Blitzscale Europe. We’ll be Europe’s largest GLP-1 provider.

• Step 3 → $100B/yr by end of 2030 : Get regulatory approval across Europe for our Full Autonomous Prescribing (FAP) system. Win contracts at scale with European payers to mass replace human labor. We’ll be the dominant full-stack AI doctor in Europe.

• Step 4 → $1T/yr by end of 2035 : With one line of code and zero human time, you can use AIOS to treat any patient globally with any medication.

In so doing, we’ll become the world’s first trillion-dollar healthcare company.

We’re a young, founder-led company. This is still Day 1 and all our work is ahead of us.

You can read more about working with us here: Working at AIOS

Being a Senior Security Engineer at AIOS

We’re building a world-class team.

As Senior Security Engineer at AIOS, your fundamental role is to make sure we know who is on our systems, what they’re using, and exactly what happened when something goes wrong.

You’ll own identity for everyone who needs access: single sign-on, MFA, conditional access, and the joiner, mover and leaver lifecycle.

You’ll own the fleet and the endpoint: device management, encryption, patching, lock and wipe when someone leaves, and endpoint detection and response from alert to containment.

You’ll own logging and detection. You’ll write detections that fire on real attacker behavior and automate the response, so when an alert fires at 3am, most of the work is already done. You’ll partner with engineering on cloud security, focused on identity and logging. AI agents and scripts handle the repeatable work so you can focus on judgment calls.

You’ll also run IT security: onboarding and offboarding for everyone, and the vendors and MSPs who handle day-to-day support.

Great performance in this role means every person and device that touches patient data is known and managed, the alerts that matter reach us fast, and any investigation can say exactly what happened.

This is a full-time, fully remote role, and you’ll work mostly async in the timezone of your choice — as long as you’re around until midday Pacific Time for calls as needed. You’ll have flex in your calendar for kids if you have them — many of our team have kids so we’re kid-friendly.

This is an individual contributor role. No management, you’ll be hands-on in the trenches. You’ll report directly to our Head of Information Security ( Ryan Bentz ). We’re intense, so you’ll also be intense.

You’ll also work most closely with our compliance and engineering leadership.

Key responsibilities

• Identity : You own the identity provider and access model: SSO and SCIM, MFA policy, conditional and device-aware access, and joiner, mover and leaver for everyone who needs access.

• Fleet : You own device management across the fleet: enrollment, encryption, patching, configuration baselines, and lock and wipe at offboarding.

• EDR : You own EDR and work endpoint incidents from alert to containment.

• Logging and detection : You decide what we collect, write and tune detections, and automate the response.

• Cloud ownership : You work with engineering on cloud identity, logging and access.

• Automation : You build the scripts and AI agents that take repeatable work off people.

• IT operations : You own onboarding and offboarding end to end, from laptop and accounts on day one to full access removal on the last day. You manage the vendors and MSPs that handle parts of this work, hold them to a high bar, and automate the rest so it runs without a ticket. You’re the escalation point for IT issues across the team.

• Incident response : You’re a first responder for security incidents.

Need to have

• Experience : You have 6+ years in security engineering, with hands-on depth across identity, endpoint and detection.

• Identity : You’ve run an identity provider hands-on: SSO and SCIM, conditional access, and device-aware policies.

• Fleet : You’ve run MDM/UEM at scale, including enrollment, encryption and remote wipe.

• EDR : You’ve run an EDR and worked incidents from alert to containment.

• Detection engineering : You’ve written detections. You can describe one, what it caught, and how you tuned out the noise.

• Attacker mindset : You know how attacks work because you’ve done them: red teaming, pentesting, bug bounties, CTFs or similar.

• Automation : You script and automate (Python, bash, etc.) and already use AI agents to do more of your work.

• Cloud security : You know enough cloud security (AWS, GCP or Azure) to partner with engineers on identity, logging and access.

• IT and vendor management : You’ve owned onboarding, offboarding and IT operations for a distributed team, including managing outside vendors or MSPs and holding them to clear standards.

• Communication : You can explain risk clearly to employees, engineers and executives.

Nice to have

• Regulated experience : You’ve worked in healthcare or another regulated environment (HIPAA, GDPR, PCI).

• Hypergrowth : You’ve owned an identity or device program through fast growth.

• Distributed workforce : You’ve secured a distributed, multi-country workforce.

• Public work : You’ve shipped tools, detections, write-ups, talks or CVEs.

Our cultural standards

We aim to make this your life's work. This should be the most challenging, most rewarding role of your life. Accordingly, these are the core cultural standards to which we hold ourselves & our team-members:

• Belief in the mission : We will have served 100 million patients by the end of 2030 and we transform the life of most patients who join. We have a lot of work to do. We are obsessed with our patients and are dedicated to the mission.

• Unwavering integrity : We are at the frontier, so we often live in ambiguity with no trodden path. When we can't look to others for guidance, we must maintain impeccable ethics and unwavering integrity.

• Only the paranoid survive : Bad sh*t is coming. By joining us, you're choosing to sail straight towards the storms with unhesitating conviction. However much we've already done, however far we've already come, it's still Day 1 and all our work is ahead of us.

• If we're average we fail : We are only interested in "insanely great", a focus on the quality of our execution that in everyday life would be considered pathological. We have a dedication to excellence and reject incompetence.

• Commitment to candor : That which can be destroyed by the truth should be. You get full transparency from the company and the company expects full transparency from you. We never say anything about someone that we wouldn't say to them directly. We give feedback with love and do not need to protect people from fleeting physical sensations.

• A maniacal sense of urgency : We execute at an intensity that most people think is impossible. Speed is critical and we need things done yesterday. We all work very hard and in such a competitive world there really is no other way to win.

…