Staff Security Engineer

• We’re looking for a Staff Security Engineer to join Fullscript’s Security Engineering team as a senior technical leader and hands-on builder
• You’ll work closely with engineering teams to design and implement security solutions that scale across Fullscript’s products and platforms
• As a Staff-level engineer, you’ll own complex technical initiatives, help shape security strategy, and influence how security is built into the software development lifecycle
• You’ll be expected to balance hands-on execution with technical leadership, mentoring engineers and helping teams solve security challenges in a way that supports both business objectives and engineering velocity
• Lead the design and implementation of security solutions across Fullscript’s applications, platforms, and AI-powered systems
• Partner with engineering teams to embed security throughout the software development lifecycle, including architecture reviews, threat modeling, secure coding practices, and design reviews
• Drive application security, product security, and vulnerability management initiatives from concept through implementation
• Own complex security challenges that span multiple teams, balancing technical requirements, business priorities, and engineering constraints to deliver scalable solutions
• Mentor engineers and security practitioners, raising the bar for secure software development and helping teams make sound security decisions
• Influence technical strategy and security standards through hands-on engineering, technical leadership, and cross-functional collaboration
• Stay ahead of emerging threats, security technologies, and AI-specific risks to help shape Fullscript’s long-term security posture

Benefits

• Reach your wellness goals with our benefits plan, discount on practitioner-grade supplements, and company-wide health and wellness programs
• Our dedicated DEIB Council ensures we advocate for equality and encourage positive change within ourselves and the community. We value the unique qualities and perspectives of our team
• You choose your own office with our Wherever You Work Well approach. Whether that’s in-person or at home, teams aren’t defined by geography. Output, not location, is our success metric so we also offer a flexible approach to your working hours, vacation, and personal days
• We empower each other to grow with lunch and learns, lean in circles, show-and-tells, and more. Everyone has something to learn and something to teach so we pride ourselves on growing as a team
• We’re not just a company — we’re a community. Team lunches, weekly town halls, birthdays, parties, and clubs are an essential part of our community and culture
• The health of our people relies on the health of our planet. We are certified carbon-neutral, taking our first big step in creating a more sustainable future- This role is ideal for someone who started their career in software engineering and developed deep expertise in security engineering, application security, or product security
• We’re looking for someone who has owned systems end-to-end; from application development and infrastructure decisions through security design and implementation; Understands how to build secure, scalable solutions in production environments
• The ideal candidate is deeply technical, highly collaborative, and energized by solving difficult problems that span multiple teams, systems, and domains
• 8+ years of software engineering experience designing, building, and operating production systems
• Excellent communication skills, strong technical judgment, and a continuous learning mindset
• Strong hands-on experience with security tooling, automation, vulnerability management, and security assessments
• Deep understanding of secure software development, modern application architectures, APIs, and cloud-native environments
• 3+ years of recent experience in application security, product security, security engineering, or a related security discipline
• Proven ability to influence technical direction, mentor engineers, and drive adoption of security best practices
• Experience owning complex technical initiatives from problem definition through delivery, including working across multiple teams and stakeholders
• Experience securing Ruby on Rails, Node.js, JavaScript, GraphQL, or similar application ecosystems
• Experience with AWS cloud security and cloud-native security controls
• Experience with threat modeling methodologies such as STRIDE, PASTA, or similar frameworks
• Experience with vulnerability management, application security posture management, or developer security tooling
• Familiarity with GitHub, GitLab, Wiz, static analysis tools, secret scanning, or related security platforms
• Experience conducting penetration testing, security research, or ethical hacking activities
• Experience protecting healthcare, regulated, or sensitive customer data- All offers are contingent on successful background checks conducted in compliance with federal, state, and provincial laws