Senior/Lead Security Engineer - HIPPA

Role overview

Responsibilities

• Convert compliance analyses and audit findings into scoped engineering backlog items with acceptance criteria, estimates, and owners; organize the backlog across relevant control areas.
• Develop and run control tests, record pass/fail results, and manage evidence requests from third-party auditors, including FedRAMP Significant Change Reviews.
• Map audit requests to NIST 800-53 controls and coordinate evidence collection and deadlines with engineering, ISRM, Privacy, and Legal.
• Generate compliance status reports and build lightweight automation, dashboards, and evidence pipelines to reduce manual audit work.
• Coordinate with security, privacy, legal, SRE, and cloud platform teams to document inherited AWS/Azure controls and internally maintained controls.

Required qualifications

• 6–15 years of overall IT experience.
• Background in security/privacy compliance, GRC, or compliance engineering supporting HIPAA and/or FedRAMP/NIST 800-53 programs.
• Understanding of HIPAA rules and safeguards, BAAs, breach notification, minimum necessary standards, and NIST 800-53 control families.
• Ability to translate regulatory language into estimable engineering backlog items using Azure DevOps, Jira, or similar tools.
• Hands-on experience supporting third-party audits such as SOC 2, FedRAMP, or HITRUST, including evidence mapping and deadlines.
• Knowledge of AWS GovCloud and/or Azure Government and controls including IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion.

Preferred qualifications

• FedRAMP Significant Change Request and assessor engagement experience; Python or Bash automation skills.
• AWS IAM or SailPoint experience and access policy management across S3, RDS, DynamoDB, and Redshift.
• Awareness of UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, or willingness to learn these regimes.
• Relevant certifications may include CIPP/US, CIPM, HCISPP, CISA, CISSP, or AWS/Azure security certifications.
• Experience with Snyk, Wiz, Qualys, or Burp; secrets or certificate rotation; or regulated-data legal-tech, healthcare, or government SaaS products.

Benefits and development

• Offers health, retirement, paid time off, and flexible benefits.
• Provides learning and development opportunities, including LinkedIn Learning, online learning, knowledge sharing, tech talks, and hackathons.
• Relocation to an EPAM office may be possible for short- or long-term projects.