Lead Security Engineer

What You'll Do10

• Run HIPAA and SOC 2 audit cycles end to end, covering scoping, evidence, and auditor management.
• Keep an AI-enabled compliance knowledge base current so control mappings and evidence stay queryable between audits.
• Own the BAA lifecycle with customers and vendors.
• Assess AWS, the S3 data lake, and AI integrations, then turn findings into a ranked remediation roadmap.
• Threat model PHI-bearing services and drive fixes with hands-on review of IAM, network boundaries, S3 access patterns, encryption, and logging.
• Write security policies, incident response procedures, and access control frameworks.
• Build detection, alerting, and evidence-collection pipelines yourself, applying AI where it removes manual steps.
• Manage risk across the AI toolchain, from enterprise LLM platforms to MCP integrations to connectors such as Slack, Gmail, and Google Drive.
• Own DLP for the data lake, including PHI quarantine architecture and access controls, along with JAMF and endpoint security.
• Guide secure SDLC work with engineering (branch protection, risk gating, dependency and secrets management), review new features before launch, and answer customer and partner security questionnaires.

Requirements9

• 6+ years in software or infrastructure engineering, with 2+ years focused on security.
• Direct experience owning a security or compliance program from start to finish.
• Personal ownership of SOC 2 audits, ideally Type II, as the accountable party rather than a contributor.
• Working knowledge of AWS security: IAM Identity Center, S3 bucket policies, CloudTrail, and GuardDuty.
• Ability to read a policy document and a Terraform or Pulumi diff and spot problems in both.
• Comfort writing code and scripting against APIs to automate compliance toil.
• Hands-on use of AI tools in engineering or security work, plus the judgment to assess LLM risks such as prompt injection, data exfiltration, model safety, and supply chain exposure.
• A record of building security programs at startups or growth-stage companies, not only maintaining them at large enterprises.
• Strong written communication for auditor-facing and customer-facing documentation.

Preferred Qualifications4

• HIPAA compliance work and securing systems that hold PHI
• PHI de-identification inside ML or AI pipelines
• Familiarity with healthcare payer or TPA ecosystems
• Securing API products and B2B data integrations

Who Should Apply

The right candidate has shipped hands-on security engineering at a startup and carried a SOC 2 Type II audit across the finish line as the accountable owner. You read Terraform diffs, write your own automation against APIs, and treat AI tools as part of the daily workflow.

Salary Insight