Sen. Full Stack Software Engineer/Tech Lead Position

Job Summary:

Roadrunner Health Services is seeking a senior full-stack software engineer / technical lead to assume technical ownership of an existing custom electronic medical record (EMR) platform used for correctional healthcare workflows. The platform uses a Laravel/PHP backend, a Next.js/React frontend, MySQL, Git/Bitbucket, and AWS infrastructure.

This is primarily a software takeover, rescue, hardening, and completion role-not a greenfield rebuild. The successful candidate must be able to understand an existing codebase, preserve working clinical functionality, identify security and architectural deficiencies, and safely complete the platform for controlled production use.

The role will work closely with executive leadership, clinical subject matter experts, operations, compliance, and external specialists as needed.

Supervisory Responsibilities:

• No direct supervisory responsibility is required initially; however, this role is expected to provide technical leadership, code-review standards, architecture guidance, and direction to contractors or additional developers when needed.

Primary Duties and Responsibilities:

• Assume technical ownership of an existing Laravel/PHP and Next.js/React codebase and establish a reliable development, staging, and production workflow.
• Perform a structured takeover assessment of source code, Git history, database schema and migrations, dependencies, AWS infrastructure, CI/CD, credentials, integrations, testing, and technical documentation.
• Develop, maintain, refactor, and complete existing clinical and operational workflows while avoiding unnecessary rewrites of working functionality.
• Design and enforce secure authorization at the role, facility, resource, patient, and action level so users cannot access protected health information outside their authorized responsibilities.
• Strengthen authentication, session security, least-privilege access, secrets management, encryption, secure file handling, audit logging, and security monitoring.
• Review and improve clinical record provenance, signatures, amendments, versioning, and auditability so historical clinical information is preserved appropriately.
• Review MySQL schema design, Eloquent relationships, migrations, constraints, indexes, data integrity, and safe production database-change practices.
• Build and maintain automated unit, feature, API, integration, regression, and security-focused tests around critical clinical workflows.
• Maintain and improve AWS infrastructure, Linux/Nginx/PHP-FPM configuration, deployment pipelines, backups, recovery procedures, monitoring, and documented restore testing.
• Support existing integrations and data-exchange workflows, including secure file transfer, external APIs, jail management system (JMS) data, reporting, and future interoperability interfaces.
• Work with clinical and operational stakeholders to translate correctional-health requirements into technically sound, testable product behavior.
• Create and maintain architecture diagrams, data dictionaries, deployment/runbook documentation, API documentation, change records, and technical decision records.
• Participate in vulnerability remediation, penetration-test remediation, release readiness, user acceptance testing, and controlled pilot deployment.
• Evaluate third-party and open-source dependencies for licensing, security, maintainability, and compatibility before adoption.
• Perform other related software engineering and technical leadership duties as required.

Initial Priorities:

• Securely transition repositories, environments, credentials, deployment processes, and infrastructure control to Roadrunner Health Services.
• Validate facility and patient-level authorization boundaries and remediate object-level access weaknesses before production use.
• Validate database migrations and the ability to rebuild the application safely from source and documented configuration.
• Harden audit/provenance controls, secrets handling, error handling, backups, restore procedures, and production deployment.
• Establish sufficient automated testing and release gates for a controlled single-facility pilot.

Required Technical Skills and Experience:

• PHP / Laravel: Advanced professional experience with modern PHP and Laravel, including Eloquent ORM, migrations, validation, policies/gates, middleware, events, queues, authentication, APIs, and testing.
• React / Next.js: Strong experience maintaining production React and Next.js applications; TypeScript or strong modern JavaScript experience required.
• MySQL / Relational Databases: Strong database design, query, indexing, migration, transaction, integrity, and performance skills.
• Git / Bitbucket: Advanced Git skills including branching, merge/rebase workflows, code review, repository history analysis, release management, protected branches, and remediation of improperly committed secrets.
• AWS: Hands-on experience with EC2, EBS, IAM, VPC/security groups, Route 53, S3, CloudWatch, secrets/configuration management, encryption/key management, backups, and secure production deployment.
• Linux / Web Infrastructure: Experience administering Linux-based application environments using Nginx, PHP-FPM, TLS/SSL, SSH access controls, logging, and service/process management.
• Application Security: Demonstrated ability to implement authentication, authorization, least privilege, role-based access control, object-level authorization, multi-tenant/facility isolation, secure sessions, encryption, secrets management, secure uploads/downloads, and vulnerability remediation.
• Testing / DevSecOps: Experience implementing automated backend/frontend tests, CI/CD controls, dependency scanning, secure deployment practices, environment separation, and production release gates.
• API / Integration Engineering: Experience designing and consuming REST APIs, secure file-transfer workflows (SFTP), third-party integrations, structured data exchange, and integration troubleshooting.

Healthcare and Security Requirements:

• Experience developing or maintaining systems that store, process, or transmit protected health information (PHI) or similarly sensitive regulated data.
• Practical understanding of HIPAA Security Rule safeguards, including access control, audit controls, authentication, transmission security, risk-based security controls, backup/recovery, and secure handling of PHI.
• Ability to identify when a healthcare workflow requires stronger provenance, record locking, amendment history, authorization, auditability, or clinical safety controls.
• Ability to work under a Business Associate Agreement (BAA) and follow organizational policies governing PHI, credentials, source code, and production access.

Preferred Experience:

• Electronic health record (EHR/EMR), eMAR/medication administration, clinical documentation, healthcare reporting, or other clinical software experience.
• Correctional healthcare, detention/jail systems, jail management system integrations, or other multi-facility healthcare environments.
• FHIR R4, US Core, USCDI, SMART on FHIR, HL7, terminology services, or healthcare interoperability standards.
• ONC Health IT Certification, ASTP/ONC certification criteria, Inferno testing, or experience preparing software for formal health-IT certification.
• Medication, e-prescribing, pharmacy, laboratory, Medicaid/X12, or other regulated healthcare integrations.
• Figma or comparable design tools and the ability to work from existing design systems, prototypes, and implemented React components. Figma expertise is helpful but is not a substitute for full-stack engineering capability.
• AWS certification, security certification, or comparable demonstrable cloud/security experience.

Experience and Education:

• Seven or more years of professional software development experience strongly preferred, including substantial responsibility for production systems.
• At least four to five years of meaningful Laravel/PHP experience strongly preferred.
• Demonstrated experience inheriting, diagnosing, refactoring, and stabilizing an existing production codebase is highly desirable.
• Bachelor's degree in Computer Science, Software Engineering, Information Systems, or a related field, or equivalent professional experience.
• Healthcare experience is strongly preferred; candidates with exceptional application-security and full-stack experience may be considered without prior ONC certification experience.

Position Core Competencies:

• Ownership and Accountability: Takes responsibility for technical outcomes, communicates risks early, and follows work through validation rather than stopping at code completion.
• Practical Problem Solving: Distinguishes what should be retained, refactored, replaced, or deferred and presents actionable solutions rather than defaulting to unnecessary rewrites.
• Security Mindset: Treats PHI protection, least privilege, auditability, credential management, and safe production practices as foundational engineering requirements.
• Clinical/Business Translation: Can work with non-technical healthcare stakeholders and convert operational or clinical requirements into clear technical behavior and acceptance criteria.
• Documentation: Produces clear code documentation, architecture notes, runbooks, deployment procedures, test evidence, and technical handoff materials.
• Communication: Communicates technical issues clearly to executive, clinical, operations, compliance, and engineering audiences.
• Judgment: Is comfortable acknowledging uncertainty, validating assumptions, and escalating decisions that affect patient safety, PHI, data integrity, or production availability.

Candidate Evaluation

Final candidates may be asked to review a sanitized portion of the existing SecureMediDocs codebase and explain what they would retain, refactor, replace, and prioritize before production deployment. Evaluation may include discussion of authorization, facility isolation, database integrity, audit/provenance, testing, AWS deployment, PHI protection, and release readiness.

Physical Requirements:

• Prolonged periods sitting at a desk and working on a computer.
• Ability to communicate effectively by telephone, video conference, email, and other electronic collaboration tools.
• Must be able to lift up to 15 pounds at a time when necessary for normal office or equipment-related tasks.