Senior Application Security Engineer

Senior Application Security Engineer

Join our existing R&D Security team as Aidoc's first dedicated Application Security Engineer. You will shape how application security works across R&D: choosing effective controls, building useful security tooling, and helping engineers adopt secure practices. You will work with security leadership, SecOps, product teams and engineers. Our products span Python services, web applications, desktop applications, mobile apps, and Aidoc servers in hospitals.

What you will do?

• Lead threat modeling and security reviews across services, web, desktop, mobile and hospital applications. Focus on customer and hospital data isolation and medical-file handling.
• Review Python and JavaScript/TypeScript code and test applications and APIs. Turn findings into practical requirements, help developers resolve them, and verify fixes, including testing for bypasses.
• Improve SAST, DAST, SCA and secrets controls across the development workflow. Work with DevOps and developers to reduce noise and make results actionable.
• Build security automation, CI integrations and validation tests. Create reusable guidance and help teams adopt standards through design discussions, code reviews and developer coaching.
• Define security requirements and verify controls for clinical inference, training pipeline code and model artifacts with AI and Data Engineering.
• Assess developer AI tools, including coding assistants, AI agents and Model Context Protocol (MCP) integrations, for sensitive-data exposure, excessive tool permissions and untrusted inputs.
• Validate application risks, recommend remediation priorities, track agreed work and measure adoption and recurring defects. Support SecOps investigations and provide technical evidence to Quality and Regulatory partners.

Responsibilities

• 5+ years of relevant experience in Application Security, Product Security, or a combination with software engineering.
• Built or substantially improved an AppSec program: selected priorities, introduced or improved tooling, gained developer adoption without formal authority, and measured results.
• Confident security review of Python and JavaScript/TypeScript, especially authorization and tenant isolation; hands-on web and API testing.
• Experience threat modeling and assessing systems you did not design, and translating findings into changes engineers can implement.
• Ability to write security automation, CI integrations and validation tests.
• Working knowledge of security risks in LLM applications, AI agents and MCP integrations, including prompt injection, sensitive-data exposure and tool permissions.
• Clear communication in English and sound judgment when explaining security trade-offs and guiding engineering teams.

Requirements

• Electron, mobile or Windows-hosted application security; C#/.NET, PowerShell or Go.
• Deeper security experience with ML training pipelines, model artifacts or inference systems.
• Healthcare integrations, patient-data protection or regulated product development.

You can develop expertise in our additional platforms and healthcare domain here. Your AppSec judgment and record of making a program work matter most.

Our Perks:

• Be part of something big - using cutting-edge technologies to transform the Healthcare industry (while saving patients’ lives)
• We work in a hybrid model, with our new offices located at 34 HaMasger Street in Tel Aviv and parking for employees.
• Amazing and healthy breakfasts and lunches prepared daily by our personal chef!
• Stocked up kitchen & meal card
• Wellness: Aidoc employees-only gym, plus Pilates, Yoga, and functional workouts classes.
• Amazing culture - collaborative, transparent & fun!
• Attractive compensation package & benefits