Senior Security & Compliance Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Define, assess, and authorize security standards and strategies throughout cloud infrastructure, applications, and integrated modules.

• Collaborate with Architecture and Engineering leadership to create security-centric designs.

• Oversee security event monitoring utilizing SIEM and EDR tools.

• Manage alert triage, complex forensic investigations, and the remediation of high-severity incidents.

• Lead vulnerability assessment and penetration testing initiatives.

• Oversee the certification program, including SOC 2 Type II, HIPAA, and relevant state regulatory requirements.

• Manage control design, operational processes, evidence collection, and relationships with auditors.

• Address customer security questionnaires and vendor risk assessments.

• Take charge of third-party and vendor risk management.

• Establish least-privilege IAM standards, which encompass SSO, MFA, and role-based access controls.

• Enhance corporate security across Microsoft Entra ID, M365, endpoint management, SaaS governance, email security, and data loss prevention.

• Mentor engineering teams on secure coding practices, threat modeling, and security reviews.

• Act as the security authority in product design and infrastructure decisions.

• Lead incident response planning, execution, root-cause analysis, post-incident reporting, and improvement of playbooks.

• Assess and implement security tools, making build-vs-buy recommendations.

• Design and conduct security awareness training and documentation programs.

• Mentor junior security engineers.

⛳️ Requirements

• Over 8 years of experience in cybersecurity engineering, security operations, or a related technical security role.

• Proven experience leading investigations or mentoring fellow engineers, preferably in a B2B SaaS environment.

• In-depth, hands-on knowledge of cloud security in AWS (preferred), Azure, or GCP, including IAM, network security groups, and logging/monitoring services.

• Demonstrated ability to design security architecture at scale.

• Practical experience with administering Microsoft Entra ID and Auth0 or comparable systems, including SSO, MFA, conditional access, and privileged access management.

• Advanced expertise with SIEM/EDR platforms such as Splunk, CrowdStrike, or Elastic, and vulnerability management tools, including tool selection and program management.

• Direct responsibility for at least one complete SOC 2 Type II or HIPAA audit cycle as the primary technical liaison for auditors.

• Experience in control design, evidence collection, and addressing audit findings.

• Familiarity with ISO 27001 is a plus.

• Hands-on experience performing HIPAA Security Rule risk analyses and managing Business Associate Agreements.

• Proven track record in secure software development practices, including threat modeling, code review, and CI/CD pipeline security.

• Experience in establishing security standards adopted organization-wide.

• Strong scripting or automation skills with Python, Bash, or similar languages.

• Exceptional communication skills and executive presence.

• Advanced security certifications are highly preferred: CISSP or CISM; HCISPP and CCSP are valued; GCIH, GCFA, GCFE, CEH, or CySA+ are advantageous.

• Experience in healthcare, senior living, or another highly regulated industry is strongly preferred.

• Previous experience mentoring or informally guiding other security engineers.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance.

• Generous paid time off and holiday leave.

• Opportunities for professional development and continuous learning.

• Flexible work arrangements, including remote work options.