About Aidoc

Aidoc is the market leader in healthcare AI and has developed the world's largest clinical frontier model, supporting nearly 50 million patients each year.

Aidoc is deployed in more than 2,000 medical centers worldwide. Since our founding in 2016, Aidoc has raised over $500 million and achieved a record number of FDA-cleared solutions.

Medical diagnosis is hitting a breaking point, where the number of physicians hasn't kept up with the rapidly growing patient load. This leads to misdiagnosis and treatment delays that result in hundreds of thousands of deaths every year. Aidoc assists clinicians by precisely highlighting diseases directly on medical images, preventing misdiagnosis and ensuring that urgent patients receive the immediate attention they need.

Senior Application Security Engineer

Join our existing R&D Security team as Aidoc's first dedicated Application Security Engineer. You will shape how application security works across R&D: choosing effective controls, building useful security tooling, and helping engineers adopt secure practices. You will work with security leadership, SecOps, product teams and engineers. Our products span Python services, web applications, desktop applications, mobile apps, and Aidoc servers in hospitals.

What you will do?

Lead threat modeling and security reviews across services, web, desktop, mobile and hospital applications. Focus on customer and hospital data isolation and medical-file handling.
Review Python and JavaScript/TypeScript code and test applications and APIs. Turn findings into practical requirements, help developers resolve them, and verify fixes, including testing for bypasses.
Improve SAST, DAST, SCA and secrets controls across the development workflow. Work with DevOps and developers to reduce noise and make results actionable.
Build security automation, CI integrations and validation tests. Create reusable guidance and help teams adopt standards through design discussions, code reviews and developer coaching.
Define security requirements and verify controls for clinical inference, training pipeline code and model artifacts with AI and Data Engineering.
Assess developer AI tools, including coding assistants, AI agents and Model Context Protocol (MCP) integrations, for sensitive-data exposure, excessive tool permissions and untrusted inputs.
Validate application risks, recommend remediation priorities, track agreed work and measure adoption and recurring defects. Support SecOps investigations and provide technical evidence to Quality and Regulatory partners.

Responsibilities

5+ years of relevant experience in Application Security, Product Security, or a combination with software engineering.
Built or substantially improved an AppSec program: selected priorities, introduced or improved tooling, gained developer adoption without formal authority, and measured results.
Confident security review of Python and JavaScript/TypeScript, especially authorization and tenant isolation; hands-on web and API testing.
Experience threat modeling and assessing systems you did not design, and translating findings into changes engineers can implement.
Ability to write security automation, CI integrations and validation tests.
Working knowledge of security risks in LLM applications, AI agents and MCP integrations, including prompt injection, sensitive-data exposure and tool permissions.
Clear communication in English and sound judgment when explaining security trade-offs and guiding engineering teams.

Requirements

Electron, mobile or Windows-hosted application security; C#/.NET, PowerShell or Go.
Deeper security experience with ML training pipelines, model artifacts or inference systems.
Healthcare integrations, patient-data protection or regulated product development.

You can develop expertise in our additional platforms and healthcare domain here. Your AppSec judgment and record of making a program work matter most.

Our Perks

Be part of something big - using cutting-edge technologies to transform the Healthcare industry (while saving patients’ lives)