Senior/Lead Security Engineer - HIPPA

Role overview

Responsibilities

• Translate HIPAA gap analyses, NIST controls, and audit findings into scoped backlog items with acceptance criteria, estimates, and owners.
• Maintain backlogs for access control, data classification, audit logging, data retention and deletion, and related compliance features.
• Test controls such as privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request; record results.
• Track third-party audit evidence requests, map them to NIST controls, and coordinate artifact collection and deadlines.
• Report compliance status and build scripts, dashboards, and evidence pipelines to reduce manual audit effort.
• Coordinate with security, privacy, legal, SRE, and cloud platform teams on inherited and internally maintained AWS/Azure controls.

Required qualifications

• 6–15 years of overall IT experience.
• Background in security/privacy compliance, GRC, or compliance engineering supporting HIPAA and/or FedRAMP/NIST 800-53 programs.
• Understanding of HIPAA safeguards, BAAs, breach notification, minimum necessary standards, and NIST 800-53 control families.
• Ability to translate regulatory requirements into estimable work items using Azure DevOps, Jira, or similar tools.
• Experience supporting third-party SOC 2, FedRAMP, or HITRUST audits, including evidence collection and control-to-evidence mapping.
• Familiarity with AWS GovCloud and/or Azure Government and IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion.

Nice to have

• FedRAMP Significant Change Request and assessor engagement experience.
• Python or Bash automation, SailPoint or equivalent identity governance tools, and experience with AWS data services.
• Knowledge of international privacy regimes or willingness to learn them.
• CIPP/US, CIPM, HCISPP, CISA, CISSP, or AWS/Azure security certifications.
• Security-scan remediation tools such as Snyk, Wiz, Qualys, or Burp, and secrets or certificate rotation experience.
• Experience with regulated legal-tech, healthcare, or government SaaS products.

Benefits

• Health, retirement, paid time off, and flexible benefits.
• Learning resources, sponsored technology talks and hackathons, and individual development opportunities.
• Possibility of relocation to an EPAM office for short- or long-term projects.