Senior Platform Security Engineer (x/f/m)

As a Senior Platform Security Engineer at Doctolib, you will be responsible for securing our cloud infrastructure and application ecosystem. Key responsibilities include designing and implementing security controls for multi-cloud environments, developing automated security checks within CI/CD pipelines, participating in security incident response processes, and conducting security testing such as SAST and DAST. Your role will bridge the platform and application security teams to create a cohesive security strategy.

Candidates for the Senior Platform Security Engineer position at Doctolib should have at least 5 years of experience in cloud and/or application security. You must possess strong knowledge of multi-cloud security best practices, expertise in Infrastructure as Code tools like Terraform, and skills in container security and Kubernetes. Familiarity with secure coding practices and certifications such as CCSP or AWS Security are advantageous.

Doctolib offers a plethora of benefits to Senior Platform Security Engineers including free health insurance for you and your family, flexible workplace options, up to 14 days of RTT, a wellbeing program with mental health support, meal vouchers, and environmental initiatives like a bicycle subsidy. You’ll also have reimbursement options for public transportation, and relocation support if you're coming from abroad!

The interview process for the Senior Platform Security Engineer position at Doctolib starts with an initial call with Talent Acquisition, followed by a technical assessment to evaluate your skill set. You'll then engage in a team interview to understand your fit within our culture, culminating with a final interview with the hiring manager to discuss your experiences and aspirations.

At Doctolib, flexibility is a core value, particularly for Senior Platform Security Engineers. You can work in a hybrid model or choose to work from the office in Paris. Additionally, you have the option to work from another EU country or the UK for 10 days each year, making it easier to balance work and life obligations.

In a multi-cloud environment, I would focus on establishing robust identity and access management controls, implementing network segmentation, and utilizing effective encryption for data at rest and in transit. Regular audits and compliance checks would also be integral to maintaining security.

I have extensive experience using Infrastructure as Code tools, particularly Terraform, to automate the provisioning and management of cloud infrastructure. This allows for consistent security configurations and faster deployment cycles. I ensure security best practices are codified in the infrastructure code.

My approach to security incident response involves predefined playbooks that outline roles and responsibilities. I emphasize swift communication, thorough investigation, and root cause analysis. Post-incident, I ensure lessons are documented and preventative measures are implemented.

I advocate for training teams on the OWASP Top 10 vulnerabilities and integrating security checks within the development lifecycle. Code reviews and automated security testing tools are vital strategies I employ to uphold secure coding standards.

To secure a CI/CD pipeline, I would incorporate automated security scans at every stage, implement role-based access controls, and ensure secrets management practices are in place to control sensitive information. Continuous monitoring and logging for anomalies are also imperative.

I have experience utilizing cloud-native security tools like AWS Security Hub and Azure Security Center. These tools provide insights and automate threat detection, helping to strengthen our security posture across cloud environments.

I stay updated on security best practices by following industry-leading blogs, participating in webinars, attending conferences, and networking with other security professionals. Continuous education is essential in adapting to the ever-evolving security landscape.

Compliance is crucial in my security strategy, as it provides a framework for establishing security controls and measuring our security posture. I ensure adherence to regulations, especially in healthcare, and implement necessary controls to protect sensitive data.

One challenging security problem was addressing a vulnerability in our API layer. I coordinated a cross-functional team to analyze the issue, developed a patch, and rolled it out. Post-incident, I led a review to prevent similar issues, which included refining our security protocols.

I believe fostering a culture of collaboration is essential. Integration of security into the development process leads to more secure code. I advocate for regular workshops and communication between teams to demystify security and ensure everyone is aligned.