Staff Security Engineer

About the role

ABOUT THE ROLE

Hi, I'm Megan https://www.linkedin.com/in/meganstewart99/, and I lead the Product Security team at Jane. Product Security work day to day with the developers building the software that 70,000+ clinics use to book, chart, and bill. My view of security is that it's a partnership with developers. The people who do well here can take complex insights and make them digestible for a busy team, and focus on fixing the cause, rather than repeatedly fixing the effects of an issue.

We need a staff-level engineer who can identify the themes that tie together the insights we uncover and work with product teams to better how we build secure software at the architecture level. There's a full roadmap behind that too: changes to how our development lifecycle and GitHub workflows run, private package repositories, maturing our SCA tooling, and a security champions program. You'd lead some of those projects outright.

We also lean into AI on this team, in the back office and in the product. We're already automating reporting and reminders, and the next step is using AI for vulnerability analysis and getting closer to the code with draft fixes. If you've been somewhere that kept AI locked away and you want to build with it, or you're already securing AI features and want to do it at scale, this is a great place for that.

WHAT IMPACT WE'RE LOOKING FOR YOU TO MAKE

- Turn recurring AppSec findings into architectural fixes by spotting the common themes across vulnerabilities and partnering with product teams to design them out, rather than patching one instance at a time.

- Lead product security projects end to end, starting with private package repositories, maturing our SCA tooling, and the changes to how our development lifecycle and GitHub workflows run.

- Build AI into how the team works, moving us from automated reminders and reporting to AI-assisted vulnerability analysis and draft fixes that land closer to the code.

- Champion secure development across Jane by building trusted relationships with developers, explaining risk in plain language, and helping long-tenured teams adopt new practices without friction.

- Own security initiatives and represent Product Security in cross-functional groups, and mentor teammates as the team's most senior hands-on engineer.

WHAT EXPERIENCE WE NEED

- Staff-level application security experience, including owning security initiatives end to end and working directly with development teams.

- A real development background. Ruby on Rails is ideal; Python, Java, or C# with a willingness to get into a Rails codebase works too. You can read a draft PR and tell whether the fix is right.

- Experience finding systemic vulnerability patterns and driving architectural fixes with engineering teams, not only reporting individual findings.

- Strong relationship skills with developers and stakeholders. You make security digestible, you're comfortable pushing back kindly, and people trust you.