Senior/Lead Security Engineer - HIPPA

Role overview

Responsibilities

• Convert compliance gap analyses, controls, and audit findings into scoped engineering backlog items with acceptance criteria, estimates, and owners.
• Maintain compliance backlog items for access control, data classification, log scrubbing, audit logging, retention and deletion, and data access restrictions.
• Develop and run control tests, including privileged-access restrictions, time-bound access, PII minimization, and deletion-on-request; document results.
• Manage auditor evidence requests and map them to corresponding NIST 800-53 controls.
• Coordinate evidence collection and deadlines with engineering, ISRM, Privacy, and Legal.
• Prepare ongoing compliance status reports for stakeholders.
• Create scripts, dashboards, and evidence pipelines to reduce manual audit work.
• Document which AWS/Azure controls are inherited and which must be maintained internally, working with relevant platform and control teams.

Required qualifications

• 6–15 years of overall IT experience.
• Security/privacy compliance, GRC, or compliance engineering background supporting HIPAA and/or FedRAMP/NIST 800-53 programs.
• Understanding of HIPAA Security and Privacy Rules, including safeguards, BAAs, breach notification, and minimum necessary standards.
• Knowledge of NIST 800-53 control families such as AC, AU, SI, and PM.
• Ability to translate regulatory language into estimable engineering backlog items using Azure DevOps, Jira, or similar.
• Hands-on third-party audit support, including evidence gathering, control mapping, and meeting auditor deadlines.
• Cloud knowledge such as AWS GovCloud and/or Azure Government, plus IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion controls.

Advantageous experience and credentials

• FedRAMP Significant Change Requests and assessor engagements are advantageous.
• Python or Bash scripting, SailPoint or equivalent identity governance, and access-policy experience are advantageous.
• International privacy regime knowledge, security-scan remediation, secrets/certificate rotation, and regulated SaaS experience are advantageous.
• CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certification is advantageous.

Benefits and development

• Offers health, retirement, paid time off, and flexible benefits.
• Provides learning and development opportunities, including online learning, external certification opportunities, Tech Talks, and Hackathons.
• Offers opportunities to contribute to international projects and relocate to an EPAM office for short- or long-term projects.