Cofactor is on a mission to reduce the cost of healthcare for all Americans. We deploy boutique automation studios into health systems to launch AI agents and applications that handle administrative work. We’re venture-backed by top investors like Drive Capital and headquartered in Chicago.
The role
Help engineers build and operate healthcare AI systems safely. This is a hands-on engineering role focused on securing cloud infrastructure, application access, document processing, and agent-driven development, not just writing policies. The responsibilities cover sandboxing, scoped credentials, protected service routes, and PHI-safe tooling.
What you’ll do
- Secure cloud and agent execution environments. Build isolated development and automation environments with restricted service accounts, network access, and secrets exposure. Validate the boundaries rather than assuming a container or VM provides sufficient isolation.
- Strengthen authentication and authorization. Audit protected routes, enforce scopes and role-based access, and help evolve authentication for external clients without exposing internal microservices directly to the internet.
- Protect sensitive data throughout its lifecycle. Review capture, encryption, transport, de-identification, retention, and deletion flows; turn identified gaps into tested controls.
- Make secure development practical. Establish clear PHI-safe tooling patterns, improve credential handling and token lifetimes, and help engineers adopt safe workflows without unnecessary friction.
- Test and remediate security weaknesses. Investigate application and infrastructure risks, implement preventive controls such as secret scanning, and verify fixes in code and deployment environments.
- Explain security clearly. Work with engineering and customer IT teams to describe data flows, access controls, deployment requirements, and known limitations accurately.
What we’re looking for
- Strong software-engineering skills: you can navigate an unfamiliar codebase, investigate root causes, and implement fixes, not only identify findings.
- Practical understanding of cloud IAM, service accounts, network isolation, secrets, and least-privilege access.
- Depth in application security, including authentication, authorization, sessions, tokens, and API trust boundaries.
- An ability to reason through threats and propose concrete technical controls, beyond awareness training or generic recommendations.
- Clear communication and sound judgment about securing AI tools and workflows that handle sensitive healthcare data.
.svg)
