Senior Information Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Safeguard Reveleer’s cloud-based healthcare SaaS platforms, AI/ML systems, infrastructure, and customer data.

• Design and manage secure architectures across AWS, Azure, and GCP.

• Implement security controls for infrastructure-as-code and policy-as-code.

• Operate CSPM/CNAPP tools to identify misconfigurations, harmful combinations, and exposed PHI data stores.

• Secure containerized and serverless workloads across EKS, ECS, and Lambda.

• Enforce network segmentation, encryption standards, and centralized key and secrets management.

• Collaborate with Data Science and AI Engineering to secure model development, training, fine-tuning, inference, and RAG pipelines handling PHI and PII.

• Conduct threat modeling for AI features and address prompt injection, insecure output handling, training data poisoning, exfiltration, and excessive agency.

• Implement AI gateways, guardrails, content filtering, validation, rate limiting, and audit logging.

• Govern the use of third-party and foundation models, including vendor reviews, data residency, retention, zero-retention, no-training, and BAA controls.

• Establish controls against shadow AI and secure the ML supply chain.

• Contribute to AI governance alongside Compliance and Legal teams.

• Embed security within CI/CD pipelines using SAST, DAST, SCA, secrets scanning, and IaC scanning.

• Perform threat modeling, secure design reviews, and code assessments for microservices, APIs, and AI-enabled features.

• Secure API and machine-to-machine authorization patterns.

• Manage software supply chain risks through SBOM generation, dependency governance, and artifact signing.

• Lead penetration testing, bug bounty initiatives, and remediation validation.

• Protect PHI and PII through classification, tokenization, de-identification, and DLP strategies.

• Oversee and optimize EDR/XDR platforms, developing detection engineering and response automation.

• Implement identity security using Microsoft Entra ID, Conditional Access, PIM, and risk-based authentication.

• Govern non-human identities, including service principals, workload identities, and AI agent credentials.

• Support Intune and MDM compliance baselines across Windows, macOS, iOS, and Android.

• Manage SaaS security posture for third-party integrations and OAuth grant risks.

• Monitor and triage alerts, investigate incidents, and coordinate responses with SOC and MDR partners.

• Build and maintain SIEM detection content, detection-as-code, log pipeline coverage, and MITRE ATT&CK mapping.

• Develop incident response runbooks, playbooks, and forensic procedures, including AI-specific scenarios.

• Automate response and enrichment through SOAR workflows, Python, and PowerShell.

• Engage in tabletop exercises, purple team activities, and post-incident reviews.

• Assist with audits and evidence collection for HIPAA, HITRUST, SOC 2 Type 2, NIST 800-53, and customer security assessments.

• Maintain inventories of assets and AI systems, risk registers, and remediation tracking.

• Conduct vendor and third-party risk assessments, particularly for AI subprocessors and data flows.

• Collaborate with Compliance to align technical controls, policies, and standards.

• Contribute to security awareness and training, including guidance on responsible AI usage.

⛳️ Requirements

• Bachelor’s degree in Computer Science, Information Security, or equivalent experience.

• 5+ years of experience in security engineering or comparable technical security roles.

• Strong expertise in cloud-native security across AWS, Azure, and GCP.

• Practical experience with SIEM, EDR/XDR, IAM, vulnerability management, and security automation.

• Familiarity with HIPAA, HITRUST, NIST, and SOC 2 requirements.

• Experience securing containerized and serverless workloads, such as EKS and Lambda.

• Preferred: CISSP, CISM, CCSP, AWS Security Specialty, or GIAC certifications.

• Preferred: Experience with Terraform, Ansible, or CloudFormation for infrastructure-as-code security.

• Preferred: Familiarity with DevSecOps pipelines and tools, such as Jenkins and Bitbucket.

• Preferred: Strong scripting abilities in Python, PowerShell, or Bash.

• Analytical and detail-oriented with robust problem-solving skills.

• Ability to balance business needs with effective risk mitigation.

• Excellent communication skills for translating complex technical topics for non-technical stakeholders.

• Collaborative and proactive in pursuing continuous improvement.

• Must complete Reveleer’s E-Verify process upon hiring.

🏝️ Benefits

• Competitive salary.

• Medical, Dental, and Vision benefits.

• 401k match.

• Generous PTO plan.