Director of Application Security

At SimplePractice, we are improving access to quality care by equipping health and wellness clinicians with all the tools they need to thrive in private practice.

More than 250,000 providers trust SimplePractice to build their business through our industry-leading software with powerful tools that simplify every part of practice management. From admin work to clinical care, our suite of innovative solutions work together to reduce administrative burden-empowering solo and small group practitioners to thrive alongside their clients.

Award-winning and people-first, SimplePractice is shaping the future of health tech. In 2026, we were recognized by BuiltIn as a Best Remote Company to Work For, Software Guru's Best Places to Code, Becker Healthcare Telehealth Companies to Know, and we won a MedTech Breakthrough Award for Best Practice Management Solution Provider.

We're looking for a Director of Security Engineering to build and lead the team responsible for protecting SimplePractice's cloud infrastructure, corporate systems, and security operations.Reporting to the CISO, you'll own our security engineering strategy, have direct influence over our vendor and tooling budget, and own execution across cloud security, vulnerability management, incident response, detection engineering, identity security, and AI-driven automation.

This is a hands-on leadership opportunity for someone who combines deep technical expertise with exceptional people skills. You'll build a team, establish their direction, and partner with leaders across the business to build practical security solutions that protect our customers without slowing down innovation.We're looking for someone who builds relationships as naturally as they solve technical problems, leads through influence rather than authority, and believes great security is a shared responsibility.

• Build and lead a high-performing security engineering team, initially hiring, mentoring, and developing two senior security engineers.
• Define and own the strategy, priorities, and outcomes for security engineering, including cloud and infrastructure security, vulnerability management, security operations, and incident response.
• Strengthen detection, monitoring, and response capabilities to improve our ability to identify and respond to security threats.
• Partner with IT and Engineering to improve identity and access management, endpoint security, cloud security posture, and infrastructure security while supporting compliance requirements such as HIPAA and SOC 2.
• Build trusted relationships across Engineering, Product, IT, Legal, Compliance, and other business functions, influencing security outcomes through collaboration and technical credibility.
• Develop a risk-based security engineering roadmap that prioritizes meaningful improvements to customer trust, resilience, and security posture.
• Drive AI-driven automation and engineering best practices that reduce manual effort, improve security effectiveness, and enable teams to operate securely at scale.
• Establish clear ownership, measurable outcomes, and a culture of accountability, continuous improvement, and shared responsibility for security.
• Manage the security tooling and vendor budget, ensuring cost efficiency, optimized vendor relationships, and high ROI on security investments.
• Oversee incident response operational readiness, participating in and shaping on-call rotations to maintain rapid incident detection and mitigation capabilities.
• Serve as a senior technical advisor to the CISO and business leaders, translating complex security challenges into clear, actionable recommendations, influencing technical strategy and organizational risk decisions.

• Extensive experience in security engineering, infrastructure security, or security operations, including leadership of technical teams and security programs.
• Deep technical expertise in AWS security, vulnerability management, incident response, detection engineering, and modern security architecture.
• Demonstrated success building, mentoring, and developing high-performing security engineering teams.
• Exceptional interpersonal and communication skills, with a proven ability to build trust and influence stakeholders at all levels of an organization.
• Experience collaborating across Engineering, IT, Product, and business teams to implement practical, scalable security solutions.
• Strong technical judgment with the ability to balance security risks, business priorities, and engineering complexity.
• Experience with cloud security platforms, endpoint protection, identity management, security monitoring, AI-driven automation tools, and compliance frameworks such as HIPAA and HITRUST.
• A hands-on, collaborative leadership style with the ability to set strategic direction while remaining technically engaged.
• A pragmatic, business-oriented approach to security that emphasizes partnership, accountability, and measurable risk reduction.

We offer a competitive benefits program including:

• Medical, dental, vision, life & disability insurance
• 401(k) plan with company match
• Flexible Time Off (FTO), wellbeing days, paid holidays, and summer Fridays
• Mental health resources
• Paid parental leave & Backup Care
• Tuition reimbursement
• Employee Resource Groups (ERGs)

California Job Applicant Privacy Notice

Thank you for your interest in opportunities at SimplePractice LLC ("SimplePractice" or "us" or "we" or "our"). Please note that when you submit your resume or application materials to us for employment purposes, you are subject to the SimplePractice California Job Applicant Privacy Notice.

For more information about our privacy practices, please contact us at privacy@simplepractice.com.

Notice to Candidates

SimplePractice has been made aware of fraudulent job postings and unaffiliated third parties posing as our recruiting team. We do not have any affiliation or connection to these situations and only post open roles on our official Careers page (simplepractice.com/careers) and reputable job boards like our official LinkedIn or Indeed pages.

All official SimplePractice recruitment emails will be sent from the domains @simplepractice.com, no-reply@greenhouse.io or noreply@linkedin.com email addresses.

Examples of fraudulent domains include careers-simplepractice.com, simplepractices.com, and simplepractice.careers.

Please note that SimplePractice will never ask candidates or new hires for money or payment of any kind at any stage of the recruitment or onboarding process.