Senior Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of and enhance Hipp’s program for product and infrastructure security.

• Collaborate with engineering teams to integrate security into system design, implementation, deployment, and operations.

• Perform architecture reviews, threat modeling, code evaluations, and specialized security assessments.

• Enhance cloud security in areas such as identity and access management, network controls, secrets management, encryption, logging, and workload configuration.

• Develop and refine vulnerability management processes across applications, dependencies, containers, infrastructure, and endpoints.

• Create security monitoring, alerting, investigative, and incident response capabilities.

• Lead preparations for incident response, including creating playbooks, conducting tabletop exercises, gathering evidence, and implementing post-incident improvements.

• Enhance controls related to authentication, authorization, tenant isolation, privileged access, and least privilege.

• Collaborate with engineering to secure AI agent tools, model integrations, retrieval systems, and access to sensitive information.

• Analyze AI-specific threats such as prompt injection, excessive agency, insecure tool usage, sensitive data exposure, and untrusted content retrieval.

• Assist in achieving HIPAA and SOC 2 compliance through technically robust and sustainable controls and evidence.

• Aid in responding to customer security evaluations, questionnaires, and technical diligence requests.

• Assess vendors and integrations for potential security and privacy risks.

• Develop security standards, documentation, and engineering guidance.

• Monitor security posture and risk using meaningful metrics.

• Mentor engineers and foster a strong security culture throughout the company.

⛳️ Requirements

• Extensive experience in securing production SaaS, cloud, or data-intensive applications.

• Profound knowledge of application security, cloud security, identity management, network security, encryption, secrets management, and secure software development.

• Experience with at least one leading cloud platform such as AWS, GCP, or Azure.

• Proven ability to identify and remediate common vulnerabilities in web applications, APIs, authentication, and authorization.

• Practical experience with threat modeling, vulnerability management, security testing, monitoring, or incident response.

• Capability to review architecture and code, consider realistic attack paths, and suggest practical mitigations.

• Experience collaborating with engineering teams to implement security controls without hindering product development.

• Strong understanding of logging, detection, investigation, and response mechanisms.

• Ability to exercise sound judgment when prioritizing security risks in a dynamic environment.

• Excellent written and verbal communication skills for both technical and non-technical audiences.

• High sense of ownership and comfort in building systems and processes from the ground up.

• Experience in securing healthcare technology or systems that handle protected health information is a plus.

• Familiarity with HIPAA, SOC 2, HITRUST, NIST, or similar frameworks is advantageous.

• Experience with infrastructure as code, container security, CI/CD security, and software supply chain controls is beneficial.

• Background in penetration testing, bug bounty programs, or adversarial security evaluations is a plus.

• Awareness of modern AI and agent security risks is desirable.

• Experience securing multi-tenant SaaS architectures is advantageous.

• Experience with endpoint security, device management, SSO, and internal corporate security is a plus.

• Relevant security certifications are appreciated but not mandatory.

• Experience as an early security hire at a startup is a plus.

• Must be eligible to work in the United States; the application will inquire if employer-sponsored work authorization is needed.

🏝️ Benefits

• Take ownership of security at a company where trust significantly impacts healthcare providers and patients.

• Influence security architecture and practices during a period of growth for both the platform and team.

• Collaborate closely with engineers, founders, product leaders, and customers.

• Tackle emerging security challenges presented by AI-driven healthcare workflows.

• Build robust systems rather than merely engaging in compliance theater.

• Have a direct impact on Hipp’s product, infrastructure, and security culture.