Senior/Lead Security Engineer - HIPPA

About EPAM

Role overview

Compliance delivery and control testing

• Convert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps features, stories, and tasks with acceptance criteria, effort estimates, and owners.
• Maintain work on access control, data classification, log scrubbing, audit logging, data retention and deletion, and data access restrictions.
• Test controls including privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion on request; document results and evidence.

Audit coordination and automation

• Manage third-party auditor evidence requests, including FedRAMP Significant Change Reviews; map requests to NIST 800-53 controls and coordinate artifacts with relevant teams.
• Produce recurring compliance status reports for stakeholders.
• Build scripts, dashboards, and evidence pipelines to reduce manual effort as the program expands.
• Document controls inherited from AWS/Azure and controls owned internally with ISRM, Privacy, Legal, SRE, and cloud platform teams.

Required qualifications

• 6–15 years of overall IT experience.
• Security/privacy compliance, GRC, or compliance engineering experience supporting HIPAA and/or FedRAMP/NIST 800-53 programs.
• Knowledge of HIPAA Security and Privacy Rules, including safeguards, BAAs, breach notification, and minimum necessary standards, plus NIST 800-53 control families such as AC, AU, SI, and PM.
• Ability to turn regulatory language into scoped engineering backlog items using Azure DevOps, Jira, or similar tools.
• Direct SOC 2, FedRAMP, or HITRUST audit support, including evidence collection, control-to-evidence mapping, and meeting auditor deadlines.
• Familiarity with AWS GovCloud and/or Azure Government and controls including IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion.

Preferred qualifications

• FedRAMP Significant Change Request and assessor engagement experience is a plus.
• Python or Bash automation, SailPoint or equivalent identity governance, and access policy management across S3, RDS, DynamoDB, or Redshift are nice to have.
• International privacy regime familiarity, including UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, is a plus; readiness to ramp up is also accepted.
• Relevant certifications may include CIPP/US, CIPM, HCISPP, CISA, CISSP, or AWS/Azure security certifications.
• Security-scan remediation tools such as Snyk, Wiz, Qualys, or Burp; secrets/certificate rotation; or regulated legal-tech, healthcare, or government SaaS experience are advantageous.

Benefits and development

• The employer describes opportunities for self-development, online learning, knowledge sharing, external certifications, and participation in tech talks and hackathons.
• Benefits listed include health, retirement, paid time off, and flexible benefits.
• The posting mentions possible relocation to an EPAM office for short- or long-term projects and forums for interests beyond work.