The Backend Developer - PHP role is responsible for owning, developing, and supporting the backend of a large production digital health platform used by Android and iOS applications through REST APIs. This onsite position combines new feature development with live production support, with a strong focus on security, reliability, performance, and the responsible handling of sensitive health and personal information.
Responsibilities
Product & API Development
Design, develop, maintain, and enhance backend services and REST APIs used by Android and iOS applications and the internal web administration portal
Collaborate with mobile developers to define API contracts, versioning, payloads, error handling, and request and response behaviour
Implement and maintain application logic covering authentication, authorisation, questionnaires, medical data, services, documents, notifications, and third-party integrations
Build and extend the EasyAdmin and Twig-based administration portal used by clinical and operations teams
Write and maintain Doctrine entities, repositories, migrations, validators, voters, event listeners, and Symfony console commands
Implement and maintain asynchronous processing using Symfony Messenger for emails, notifications, algorithm recalculation, file scanning, imports and exports, recordings, and similar background jobs
Maintain OpenAPI and Nelmio API documentation and internal technical documentation covering APIs, integrations, data models, configuration, and deployment
Data, Performance & Reliability
Manage database interactions, including schema design, query optimisation, migrations, and MySQL troubleshooting
Optimise API response times, N+1 queries, Redis caching, and overall backend performance
Implement robust logging, exception handling, monitoring, and alerting, including Bugsnag
Support development, user acceptance testing, staging, and production environments
Security & Sensitive Data
Maintain JWT authentication, refresh tokens, role-based access control, and two-factor authentication processes
Apply secure coding practices across APIs, file uploads, webhooks, and administration interfaces
Protect sensitive patient, medical, and insurance data in transit and at rest
Support vulnerability remediation and address findings from security reviews and penetration tests
Maintain file-scanning and malware-protection processes for uploaded medical documents
Support partner API integrations across telemedicine, insurer and eligibility services, geocoding, and analytics
Releases, DevOps & Production Support
Participate in application releases and coordinate backend deployments with mobile application releases
Collaborate with DevOps and infrastructure teams on Dockerised deployments, continuous integration and continuous delivery, Azure services, monitoring, backups, and disaster recovery
Investigate production incidents involving APIs, databases, workers, integrations, authentication, and mobile-to-backend communication
Conduct root-cause analysis and implement permanent resolutions rather than relying only on temporary fixes
Proactively identify recurring issues and improve system stability, observability, and operability
Ways of Working
Participate in Agile and Scrum activities, including sprint planning, backlog refinement, daily stand-ups, reviews, and retrospectives
Manage development activities, enhancements, defects, and production support through Jira
Use Git and established software development lifecycle practices covering branches, reviews, and releases
Communicate effectively with mobile development, Quality Assurance, infrastructure, security, business, clinical, and operations stakeholders
Requirements
4+ years of backend development experience, preferably in PHP and Symfony
Hands-on experience supporting production applications
Previous experience with backends that serve mobile applications is strongly preferred
Experience working in Agile and Scrum teams
Comfortable collaborating with non-engineering stakeholders, including clinical, operations, content, and customer service teams
Strong experience with PHP 8+ and Symfony; experience with Symfony 5, 6, or 7 is ideal, and the current codebase uses Symfony 7.2
Strong experience designing and building REST APIs, including JSON, HTTP/HTTPS, authentication, versioning, and error handling
Strong experience with Doctrine ORM or an equivalent ORM and MySQL, including schema design, relationships, migrations, query optimisation, and troubleshooting
Experience supporting backends used by Android and iOS applications, including mobile request and response flows, authentication token handling, and push-notification backends
Solid understanding of authentication and authorisation, including JWT, refresh tokens, role and permission models, and session-based web authentication
Experience with Docker and local or containerised development
Experience with Git, code reviews, and a structured release process
Experience with application logging, monitoring, and production debugging
Good working knowledge of Agile, Scrum, and Jira
Ability to work with a large existing codebase covering multiple domains, entities, APIs, administration screens, and background jobs rather than only greenfield services
Experience with Microsoft Azure, including application hosting, Azure Database for MySQL, Blob Storage, networking, and SSL
Experience with Symfony Messenger or an equivalent queue and worker system for asynchronous jobs
Experience with Redis for caching
Experience with EasyAdmin, Sonata, or similar administration and CRUD frameworks
Experience with Twilio, Firebase, Apple Push Notification Service, Stripe, or similar third-party API integrations
Experience with multilingual or internationalisation systems
Operational understanding of Nginx and PHP-FPM
Experience with Bugsnag, Mixpanel, Application Insights, Sentry, or similar observability and analytics tools
Experience with spreadsheet imports and exports using PhpSpreadsheet, data migrations, and console commands
Experience in secure API development and least-privilege access control
Understanding of authentication and authorisation, including JWT, refresh tokens, two-factor authentication, and role-based access; familiarity with OAuth 2.0 or single sign-on would be an advantage
Understanding of encryption in transit through TLS and encryption at rest
Experience securely handling passwords, tokens, files, and secrets
Knowledge of webhook signature verification and secure third-party callbacks
Understanding of file upload security and malware scanning
Understanding of common web and API vulnerabilities covered by the OWASP API Security framework and OWASP Top 10, including injection, broken authentication, insecure direct object references or broken object-level authorisation, mass assignment, cross-site scripting, cross-site request forgery, open redirects, and insufficient rate limiting
Experience implementing audit logging for sensitive data changes
Experience remediating vulnerabilities and addressing penetration-test findings
Knowledge of secure PHP and Symfony development practices, including input validation, output encoding, parameterised queries, and session hardening
About the company
A global organisation in the medical services industry, providing technology-supported healthcare solutions and professional medical guidance across international markets. The organisation brings together medical expertise, digital capabilities, and data-informed services to support individuals throughout different stages of their healthcare journeys.