Senior Full-Stack Engineer — Application Security

Location Menlo Park, CA (San Francisco Bay Area)

Working arrangement Hybrid

Simulation
95 is building at the intersection of artificial intelligence, healthcare, and life sciences. We believe meaningful progress starts with people who understand the hardest problems firsthand. We're bringing together experts, researchers, and builders to turn that understanding into technology that matters.

For curious people who take their craft seriously, this is an opportunity to help shape something early- with challenging problems, meaningful responsibility, and room to make a lasting contribution.

You will build the applications that support expert onboarding, data collection, document handling, review, and delivery. Your work will span the front end, back end, APIs, and databases, from initial design through production.

Application security is central to this role. The software handles sensitive information and proprietary work, so access controls, data handling, and security testing must be part of everyday engineering decisions. This is a senior individual contributor position with responsibility for architecture, implementation, and product quality.

• Develop product features across user interfaces, back-end services, data models, and integrations.
• Implement authentication, authorization, secure sessions, and appropriate separation of customer, project, and user data.
• Build secure workflows for uploading, processing, storing, sharing, and deleting documents and data.
• Review designs and code for security weaknesses, explain their impact, and implement fixes.
• Add automated tests, dependency checks, secret scanning, and security checks to development and release workflows.
• Improve monitoring, audit trails, error handling, and recovery while keeping sensitive information out of logs.
• Investigate production failures, address vulnerabilities, improve performance, and document technical decisions.

• Experience shipping and maintaining production applications across the full stack.
• Strong back-end development skills, including API design, relational databases, background processing, and third-party integrations.
• Experience implementing authentication and server-side authorization, including tests that prevent access to another user's or customer's data.
• Practical knowledge of injection, cross-site scripting, broken access controls, unsafe external requests, and other web application vulnerabilities.
• Experience deploying and troubleshooting cloud applications.
• Ability to work independently, explain technical tradeoffs, and communicate with technical and nontechnical colleagues.

• Applications that handle confidential business, research, or health information.
• Enterprise identity integrations, single sign-on, and multifactor authentication.
• Threat modeling, penetration-test remediation, or security-focused code review.
• AI application security, including prompt injection, unintended data exposure, and permission controls for tools connected to models.
• Data provenance, versioning, and workflows with traceable review and approval.