DevOps Engineer

Doximity is transforming the healthcare industry. Join our mission to help every physician be more productive and provide better care for their patients. As medicine's largest network in the United States, there's an elevated level of responsibility in everything we do. We don't take that responsibility lightly and are committed to building diverse teams with an inclusive culture that can make a direct impact on the healthcare system.

One of Doximity's core values is stretching ourselves. Even if you don't check off all the boxes below we encourage you to apply. Doximity is full of exceptional people that don't fit a mold, join us!

We are looking for an experienced DevOps engineer to join our Infrastructure Security team. You will contribute and own Security efforts for our entire application and infrastructure stack as well as support and build products alongside our 300+ person engineering team used by millions of medical professionals. 

This role can be filled in our San Francisco Headquarters or remotely in the U.S.

How you’ll make an impact:

• Help maintain our private security bug bounty program hosted on Hackerone: this involves engaging security researchers, validating security finds, determining impact/risk, awarding bounties, and fixing or coordinating remediation efforts.
• Develop, schedule, and execute automated security audits on infrastructure using industry-standard security frameworks like the CIS Benchmark.
• Help set good security posture in our Terraform modules, Helm charts, Ansible playbooks, etc that other teams will leverage. 
• Active participation in the design, implementation, and maintenance of the development, staging, and production infrastructure and application security.
• Analyze HTTP traffic to create and update WAF rules to reduce the effectiveness of malicious bots, scrappers, and attackers
• Lead security/policy-related audits such as SOC2 Type II.
• Work with key stakeholders to document existing security policies and create new ones.
• Remediate security problems following our Security Incident Response (SIR) process and write post-mortem reports for security-related issues.
• Continuously improve our security observability using a variety of tools
• Periodically audit and rotate access credentials.

What we’re looking for:

• Extensive AWS knowledge and experience
• Solid understanding of Kubernetes primitives and Helm
• Automation experience with configuration and resource management tools such as Terraform and Ansible
• Experience with CI and CD using tools such as Github Actions, Atlantis, CircleCI, Terraform testing
• Ability to work in a proactive manner

Nice to haves:

• Experience writing application and/or security penetration tests with an open-source framework.
• Intermediate to advanced experience administering a WAF …