About AIOS

AIOS is building the world’s first full-stack AI doctor.

We’re at $450M ARR, growing from $7M/yr in April 2025. We’re faithfully serving 200k/mo patients via Bolt Pharmacy, our main UK brand. We’ve just launched Bolt Med, our international brand. We’re profitable.

Our strategy exists at the intersection of two strong theses:

The AI doctor that wins will get to escape velocity using GLP-1s, the fastest growing consumer product in history.

The $2T European healthcare market is overlooked by the most talented builders.

Our master plan:

Step 0 → $100M/yr by end of 2025: We went from $10M to $100M in 6 months serving the UK GLP-1 market.

Step 1 → $1B ARR by end of 2026: Since April 2025 we've grown from 3k to 200k UK active GLP-1 patients. We’ll continue this growth curve to hit $1B ARR.

Step 2 → $10B ARR by end of 2028: Blitzscale Europe. We’ll be Europe’s largest GLP-1 provider.

Step 3 → $100B/yr by end of 2030: Get regulatory approval across Europe for our Full Autonomous Prescribing (FAP) system. Win contracts at scale with European payers to mass replace human labor. We’ll be the dominant full-stack AI doctor in Europe.

Step 4 → $1T/yr by end of 2035: With one line of code and zero human time, you can use AIOS to treat any patient globally with any medication.

In so doing, we’ll become the world’s first trillion-dollar healthcare company.

We’re a young, founder-led company. This is still Day 1 and all our work is ahead of us.

You can read more about working with us here: Working at AIOS

Being a Senior Security Engineer at AIOS

We’re building a world-class team.

As Senior Security Engineer at AIOS, your fundamental role is to make sure we know who is on our systems, what they’re using, and exactly what happened when something goes wrong.

You’ll own identity for everyone who needs access: single sign-on, MFA, conditional access, and the joiner, mover and leaver lifecycle.

You’ll own the fleet and the endpoint: device management, encryption, patching, lock and wipe when someone leaves, and endpoint detection and response from alert to containment.

You’ll own logging and detection. You’ll write detections that fire on real attacker behavior and automate the response, so when an alert fires at 3am, most of the work is already done. You’ll partner with engineering on cloud security, focused on identity and logging. AI agents and scripts handle the repeatable work so you can focus on judgment calls.

You’ll also run IT security: onboarding and offboarding for everyone, and the vendors and MSPs who handle day-to-day support.

Great performance in this role means every person and device that touches patient data is known and managed, the alerts that matter reach us fast, and any investigation can say exactly what happened.

This is a full-time, fully remote role, and you’ll work mostly async in the timezone of your choice — as long as you’re around until midday Pacific Time for calls as needed. You’ll have flex in your calendar for kids if you have them — many of our team have kids so we’re kid-friendly.

This is an individual contributor role. No management, you’ll be hands-on in the trenches. You’ll report directly to our Head of Information Security (Ryan Bentz). We’re intense, so you’ll also be intense.

You’ll also work most closely with our compliance and engineering leadership.

Key responsibilities

Identity: You own the identity provider and access model: SSO and SCIM, MFA policy, conditional and device-aware access, and joiner, mover and leaver for everyone who needs access.

Fleet: You own device management across the fleet: enrollment, encryption, patching, configuration baselines, and lock and wipe at offboarding.

EDR: You own EDR and work endpoint incidents from alert to containment.

Logging and detection: You decide what we collect, write and tune detections, and automate the response.

Cloud ownership: You work with engineering on cloud identity, logging and access.

Automation: You build the scripts and AI agents that take repeatable work off people.