Senior/Lead Security Engineer - HIPPA

Role overview

Responsibilities

• Turn HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps features, stories, and tasks with acceptance criteria, effort estimates, and owners.
• Maintain backlogs for access control, data classification, log scrubbing, audit logging, data retention and deletion, and data access restrictions.
• Test controls and document pass/fail evidence, including privileged access, time-bound SailPoint access, PII minimization, and deletion-on-request.
• Manage third-party auditor evidence requests, including FedRAMP Significant Change Reviews.
• Map audit requests to NIST controls and coordinate evidence collection with engineering, ISRM, Privacy, and Legal.
• Prepare recurring compliance status reports.
• Build scripts, dashboards, and evidence pipelines to reduce manual audit work.
• Document inherited AWS/Azure controls and internally owned controls with ISRM, Privacy, Legal, SRE, and cloud platform teams.

Requirements

• 6–15 years of overall IT experience.
• Experience in security/privacy compliance, GRC, or compliance engineering supporting HIPAA and/or FedRAMP/NIST 800-53 programs.
• Knowledge of HIPAA safeguards, BAAs, breach notification, minimum necessary standards, and NIST 800-53 control families such as AC, AU, SI, and PM.
• Ability to turn regulatory language into scoped engineering backlog items using Azure DevOps, Jira, or similar tools.
• Third-party audit support experience, including evidence collection, control-to-evidence mapping, and meeting deadlines.
• Familiarity with AWS GovCloud and/or Azure Government and controls including IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion.

Additional qualifications

• FedRAMP Significant Change Request experience and assessor engagements are nice to have.
• Python or Bash automation, SailPoint or equivalent identity governance, and international privacy-regime familiarity are nice to have.
• CIPP/US, CIPM, HCISPP, CISA, CISSP, or AWS/Azure security certifications are nice to have.
• Security scan remediation tools such as Snyk, Wiz, Qualys, or Burp and secrets/certificate rotation experience are nice to have.
• Legal-tech, healthcare, or government SaaS experience with regulated data is a plus.

Benefits and development

• Offers include health, retirement, paid time off, and flexible benefits.
• Professional development includes learning resources, knowledge sharing, sponsored talks and hackathons, and individual development support.
• The posting mentions possible relocation to an EPAM office for short- and long-term projects.