About the Company

Spruce is a cloud-based healthcare communications platform that powers clinical workflows for both in-person and remote care. Since launching in 2016, we've grown to support more than 50,000 healthcare professionals working in practices of every size, from solo practices to large multi-site, multi-specialty groups.

Our platform spans telemedicine, telephony, secure messaging, team collaboration, and workflow automation. Spruce is widely used and loved by small- to medium-sized medical practices across the United States, with a 4.9+ rating across 100K+ reviews.

About the role

This is a foundational role: the first engineer at Spruce whose only job will be security. You'll join our fully remote, tight-knit, and lean engineering team, report directly to our CTO, and lead security across every entry point: our application and infrastructure, our people, our IT systems, and our employees' devices.

Everyone at Spruce stays responsible for security, and you'll make it easier for them to do it well. You'll build on what's already in place: taking ownership of work that's been shared across the team, driving concrete projects forward, and shaping how we discuss and prioritize security as we grow. As our in-house security expert, you'll advise teammates when they want to connect an AI agent to a new system, bring on a new vendor, ship a sensitive feature, or handle an unusual support request.

A bit about our stack: our backend is written in Go, as services that interact via gRPC, and our client-facing APIs are specified in GraphQL. Our web and desktop apps are written in TypeScript and React, running in the browser and as an Electron app. Our mobile apps are native: Swift and Objective-C on iOS, and Kotlin and Java on Android. We use Terraform to manage our infrastructure on AWS. Beyond engineering, we're a fully remote company on Mac endpoints, with internal tools accessed over a VPN.

The systems you'll protect operate in a high-reliability healthcare environment where correctness, security, and uptime are critical, and where your decisions protect clinical workflows and customer data.

You’ll feel at home here if you measure success by risks actually closed, and if no task is beneath you when it gets the issue resolved.

Key Responsibilities

• Build and own Spruce's security roadmap across every entry point, prioritized by risk and feasibility, and track progress over time
• Secure AI across Spruce, from the tools and agents we use to the AI features we ship
• Own endpoint security and MDM for our remote team, keeping machines with access to sensitive internal tools locked down without slowing people down
• Strengthen our support protocols and tooling against social engineering, so sensitive customer requests are verified securely and consistently
• Pen-test Spruce and review code across the stack to protect customer data, using AI to find vulnerabilities faster and driving fixes to completion
• Partner with our infrastructure team on ongoing security reviews of AWS, and lock down access to code repositories, CI/CD, and internal systems
• Partner with leadership on our SOC 2 and HIPAA compliance programs, and vet new vendors and security partners
• Lead security incident response and monitoring, test that our defenses catch simulated attacks, and run company-wide training

Desired Skills and Experience

• 8+ years in security engineering, including owning security at a distributed software company, ideally in healthcare or another regulated (SOC 2, HIPAA) environment
• Broad experience across application, cloud (AWS), and corporate security, with depth in at least one
• Hands-on experience running MDM and endpoint security for a remote macOS fleet
• Proven offensive skills, including penetration testing, red teaming, and social engineering
• A builder as much as a breaker: you write solid code (Go and TypeScript a plus) and build the tooling and automation that let one person cover a whole company
• Actively use LLMs and agents to find vulnerabilities, and understand the risks AI introduces, while still being independently strong at all tasks and roles without AI assistance
• Energized by building security from the ground up, ideally having already been a first or early security hire elsewhere, with a pragmatic focus on real risk
• Clear written communicator on a distributed team, able to explain findings, business risk, and fixes to engineers and non-technical colleagues alike