Staff, Security Engineer (App & Product Sec)

ABOUT SPRINTER HEALTH At Sprinter Health, our mission is reimagining how people access care by bringing it directly to their homes. Nearly 30% of patients in the U.S. skip preventive or chronic care simply because they can’t get to a doctor’s office. For many, the ER becomes their first touchpoint with the healthcare system, driving over $300B in avoidable costs every year. By using the same technologies that power leading marketplace and last-mile platforms, we deliver care where people are, especially those who need it most. So far, we’ve supported more than 2 million patients across 22 states, completed 130,000+ in-home visits, and maintained a 92 NPS. Our team of clinicians, technologists, and operators has raised over $125M from investors like a16z, General Catalyst, GV, and Accel and enjoys multi-year runway. ABOUT THE ROLE We’re looking for a Staff Security Engineer to be Sprinter’s first dedicated security hire and help build the foundation for how security scales across the company. This is a high-ownership role for someone who can operate strategically and hands-on. You’ll define our security roadmap, strengthen our cloud and application security posture, support HIPAA, SOC 2, and HITRUST readiness, and partner closely with engineering, product, IT, legal, operations, and leadership to make security a core part of how we build and operate. As our first security function hire, you will not just execute against an existing program. You’ll help decide what the program should be. That includes designing controls, implementing tools, driving vulnerability management, supporting partner security reviews, improving IAM, embedding security into the SDLC, and helping Sprinter make smart risk decisions as we scale. This role is ideal for someone who wants to build a security function from the ground up in a high-growth, mission-driven healthcare company. OFFICE LOCATION We are a hybrid company based in the Bay Area with offices in both San Francisco and Menlo Park. For this role, we are also open to considering remote candidates. We will give priority to candidates who are based in or open to working from the San Francisco Bay Area. WHAT YOU WILL DO - Build and lead Sprinter’s security program as the company’s first dedicated security hire - Define and execute a practical security roadmap across cloud infrastructure, application security, compliance, identity, vendor risk, and incident readiness - Design, implement, and maintain security controls that support HIPAA, SOC 2, and HITRUST requirements - Partner with legal, product, IT, engineering, and operations teams to ensure ongoing audit readiness and compliance maturity - Improve security across AWS and GCP environments, including IAM, networking, encryption, secrets management, and cloud-native application security - Evaluate and implement security tooling for vulnerability management, cloud security posture management, security monitoring, DAST, and related needs - Lead vulnerability management efforts across applications, infrastructure, cloud environments, and third-party systems - Coordinate penetration testing efforts, work with external security partners, and drive remediation with engineering teams - Embed security into the software development lifecycle through secure design reviews, CI/CD checks, developer guidance, and pragmatic security standards - Own or support partner, customer, and vendor security reviews, including questionnaires, risk assessments, and remediation planning - Strengthen identity and access management across internal systems, applications, and cloud environments - Develop clear security policies, procedures, documentation, and reporting for internal teams and senior leadership - Advise on AI security best practices as Sprinter adopts and builds AI-enabled systems, including data handling, model risk, application security, and privacy controls - Build strong working relationships across teams so security is viewed as a partner to the business,