Senior Security Engineer

This is a fully remote position, open to applicants in California.

📋 Description

• Design, implement, and uphold security measures across AWS cloud infrastructure that adheres to HIPAA regulations and is SOC 2 audited.

• Lead and/or assist in threat modeling, conducting security design reviews, and performing secure code assessments.

• Oversee vulnerability management across both cloud and application layers.

• Develop and sustain logging, monitoring, and SIEM alerting systems for effective detection and incident response.

• Create and maintain incident response playbooks; actively participate in and lead incident responses when necessary.

• Collaborate with Engineering to integrate security practices into CI/CD pipelines and infrastructure-as-code.

• Manage identity and access controls, ensuring least privilege IAM, enforcement of SSO/MFA, and conducting access reviews.

• Assist with compliance initiatives and audits for SOC 2 Type II, HITRUST, and HIPAA risk assessments.

• Be responsible for evidence collection and control documentation.

• Assess and implement CSPM, EDR/XDR, and vulnerability scanning solutions.

• Guide engineers on secure development methodologies and act as a designated security point of contact.

• Collaborate with Engineering, IT, and Compliance teams, reporting to the Vice President of Regulatory Affairs and Quality Management.

⛳️ Requirements

• Bachelor’s degree in computer science with over 7 years of experience in security engineering, infrastructure security, or a related field.

• Practical experience in securing cloud environments (AWS preferred; knowledge of Azure/GCP is an advantage).

• Familiarity with compliance frameworks such as HIPAA, SOC 2, ISO 27000 series, or similar in a regulated setting.

• Expertise in infrastructure-as-code (Terraform or similar) and scripting/automation (Python, Bash, or similar).

• Experience in vulnerability management, SIEM/logging platforms, and incident response protocols.

• Working understanding of identity and access management, Zero Trust concepts, and secure network architecture.

• Excellent communication abilities—capable of articulating risks and trade-offs effectively to both technical and non-technical audiences.

• Previous experience in healthcare, health IT, or another highly regulated sector is advantageous.

• Relevant certifications (CISSP, CCSP, OSCP, or similar) are beneficial but not mandatory.

🏝️ Benefits

• Stock Options

• Flexible PTO

• Medical, dental, vision insurance

• Life insurance

• Maternity and Paternity Leave

• 401K matching

• Apple equipment

• Sponsorship for conferences, continuing education, etc.

• Dynamic engineering role—technological innovation is central to our operations.

• Growth and learning opportunities in a startup environment, collaborating closely with an international team of scientists, engineers, platform architects, programmers, and professionals.

• Engage in morally benevolent work!