Senior Platform Security Engineer, SOC 2 / HIPAA

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop identity, authentication, authorization, secrets management, and production access controls.

• Create the architecture and code for security, privacy, and compliance measures.

• Establish isolation among environments, tenants, workloads, and sensitive information.

• Construct audit logs and change histories that are suitable for external auditor evaluations.

• Uphold SOC 2 Type II and HIPAA technical controls.

• Automate access reviews and evidence gathering processes.

• Address technical audit findings and collaborate with auditors during assessments.

• Develop secure CI/CD release pathways and infrastructure-as-code controls with production approvals.

• Publish shared modules and reference implementations.

• Execute threat models for critical workflows and translate findings into engineering requirements.

• Review code, infrastructure, and architecture changes that are security-sensitive.

• Manage engineering-side logging, detection, runbooks, and escalation procedures.

• Lead or assist in incident investigation and containment efforts.

• Engage in tabletop exercises alongside the Trust Product Manager and leadership team.

• Convert NIST requirements into actionable controls and priorities.

• Provide technical leadership with a roadmap for state and federal environments aligning with FedRAMP practices.

• Act as a senior engineer and technical lead for platform security, privacy, and compliance controls.

• Collaborate with the Trust Product Manager, Product leadership, Engineering leadership, auditors, and other engineers.

⛳️ Requirements

• Minimum of 7 years of software engineering experience.

• Several years of experience as a senior or lead engineer on production systems.

• Committed application and infrastructure code developed in the last year or two.

• Hands-on experience with SOC 2 Type II and HIPAA, including implementing and managing controls through audits.

• Experience in building or managing a system that handles protected health information.

• Cloud-native production experience, preferably on AWS.

• Familiarity with infrastructure as code and CI/CD pipelines that include approval steps.

• Capability to independently set up production environments.

• Experience in designing authentication, role- or attribute-based authorization, service identities, secrets management, production access controls, and audit logging.

• Conducting threat modeling that is implemented in shipped controls.

• Experience in resolving audit, penetration test, or incident findings.

• Ability to assess what to enforce in software versus processes and communicate trade-offs to product leads, auditors, and engineers.

• Capacity to work independently while architectural and operational models are still developing.

• Must reside in the U.S.

• Bonus: Familiarity with NIST 800-53 or other 800-series controls linked to system modifications.

• Bonus: Experience with FedRAMP or ISO 27001.

• Bonus: Automated evidence collection or continuous control monitoring accepted by auditors.

• Bonus: Experience in incident-response runbooks or tabletop exercises.

• Bonus: Experience with Node, TypeScript, and AWS in the same production environment.

• Bonus: Software experience catering to government, healthcare, or fintech clients.

🏝️ Benefits

• Fully remote position within the U.S.

• Full-time employment through an Employer of Record (EOR).

• Genuine technical ownership of design decisions and control-building priorities.

• Direct collaboration with Product & Engineering leadership.

• Mission-driven impact in safeguarding the data of families relying on public benefits.