Senior Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, implement, and sustain security controls across Rezilient’s cloud infrastructure, which encompasses network security, encryption, secrets management, logging, and configuration hardening.

• Create and oversee security guardrails utilizing infrastructure as code, cloud-native security tools, and automated policy enforcement.

• Continuously evaluate cloud environments for misconfigurations, excessive permissions, and exposure risks, and facilitate remediation efforts with Engineering.

• Ensure that PHI and PII are safeguarded at rest and during transit, implementing appropriate data classification, access restrictions, and retention controls.

• Collaborate with Product and Engineering teams to integrate security into the software development lifecycle, from design to release.

• Lead threat modeling and security design reviews for new features, integrations, infrastructure, and architectural decisions.

• Manage application security tooling and processes, including static and dynamic analysis, dependency and container scanning, and secure code review.

• Establish secure development standards and mentor engineers on secure coding practices and common vulnerability categories.

• Evaluate the security of third-party integrations, APIs, and EHR and partner data exchanges that handle patient data.

• Collaborate with IT to design and implement identity and access management controls, including SSO, MFA, role-based access, least privilege, and access reviews.

• Develop and refine security monitoring, logging, and alerting systems to identify suspicious activities across cloud, application, identity, and endpoint layers.

• Act as a technical lead during security incidents, coordinating investigation, containment, eradication, recovery, and post-incident review.

• Create and maintain incident response runbooks and conduct tabletop exercises with cross-functional teams.

• Oversee the vulnerability management program, including scanning, prioritization, remediation tracking, and coordination of penetration tests.

• Monitor the threat landscape relevant to healthcare and cloud environments, proactively adapting defenses.

• Generate evidence for technical controls for SOC 2, HIPAA/HITECH, HITRUST, and related frameworks.

• Assist with audits, risk assessments, and remediation efforts by providing technical expertise, documentation, and control testing.

• Contribute to the formulation of security policies, standards, and procedures, ensuring they are both technically sound and practical for operations.

• Serve as a trusted security advisor to Engineering, Product, IT, and leadership, translating technical risks into clear business impacts and recommendations.

• Automate security processes to minimize manual tasks through scripting, tooling, and integration.

• Support security awareness initiatives by providing practical, role-specific guidance for engineers and staff.

• Assist in shaping the long-term information security roadmap and mentor team members as the security function expands.

⛳️ Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience.

• Over 5 years of experience in information security, security engineering, or a closely related technical role, preferably in healthcare, digital health, or SaaS/cloud environments.

• Extensive hands-on experience securing AWS cloud environments, including IAM, networking, encryption, logging, and cloud-native security services.

• Strong expertise in application security, including threat modeling, secure code reviews, and security testing tools integrated within CI/CD pipelines.

• Experience with identity and access management, endpoint security, and security monitoring or SIEM tools.

• Demonstrated experience leading or facilitating incident response and vulnerability management programs.

• Familiarity with security and compliance frameworks such as SOC 2, HIPAA/HITECH, HITRUST, ISO 27001/27002, or NIST CSF, along with experience providing technical evidence for audits.

• Proficiency in scripting or programming (e.g., Python, Go, or Bash) and experience with infrastructure as code (e.g., Terraform).

• Exceptional communication skills, capable of articulating technical risks to both technical and non-technical stakeholders.

• Comfortable working as a senior individual contributor in a dynamic startup environment with significant ownership.

• Experience in protecting PHI or other regulated data is highly preferred.

• Relevant certifications such as CISSP, CCSP, OSCP, GIAC (e.g., GCIH, GCLD, GWAPT), or cloud security certifications are advantageous.

🏝️ Benefits

• Meaningful ownership through stock options, enabling you to share directly in the value you help create as we grow.

• Competitive base compensation.

• Comprehensive medical, dental, and vision coverage options, with Rezilient contributing toward your premiums.

• Complimentary access to Rezilient's clinical programs for you and your household members, providing the same connected care we deliver to our patients.

• 401(k) retirement plan to support your long-term financial well-being.

• Flexible Paid Time Off, allowing you to recharge without counting days.

• Dedicated Paid Sick Leave, separate from your FTO, for when health needs come first.

• 11 paid company holidays each year.

• Paid family leave to support you through life's significant moments.

• Optional ancillary benefits, including life insurance, disability coverage, and a Health Savings Account (HSA).