Senior/Lead Security Engineer - HIPPA

Role overview

Compliance engineering and testing

• Convert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps Features, Stories, and Tasks with acceptance criteria, estimates, and owners.
• Organize the compliance backlog across access control, data classification, log scrubbing, audit logging, data retention and deletion, and data access restrictions.
• Develop and run control tests, including privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion on request; record pass/fail results.
• Build lightweight scripts, dashboards, and evidence pipelines to reduce manual work in future audits.

Audits and stakeholder coordination

• Manage intake, tracking, and completion of third-party auditor evidence requests, including FedRAMP Significant Change Reviews.
• Map audit requests to NIST 800-53 controls and coordinate artifact collection and auditor deadlines with engineering, ISRM, Privacy, and Legal.
• Provide regular compliance status updates to stakeholders.
• Work with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document inherited AWS/Azure controls and controls requiring internal implementation or maintenance.

Required qualifications

• 6–15 years of overall IT experience.
• Background in security/privacy compliance, GRC, or compliance engineering supporting HIPAA and/or FedRAMP/NIST 800-53 programs.
• Understanding of HIPAA Security and Privacy Rules, safeguards, BAAs, breach notification, minimum necessary standards, and NIST 800-53 control families.
• Ability to translate regulatory language into scoped engineering backlog items using Azure DevOps, Jira, or similar tools.
• Hands-on third-party audit experience, such as SOC 2, FedRAMP, or HITRUST, including evidence collection, control-to-evidence mapping, and auditor deadlines.
• Knowledge of AWS GovCloud and/or Azure Government and controls such as IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion.

Preferred qualifications

• FedRAMP Significant Change Request and assessor engagement experience is a plus.
• Python or Bash scripting, AWS identity governance tools such as SailPoint, and access-policy experience across S3, RDS, DynamoDB, and Redshift are a plus.
• Knowledge of UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA is a plus; willingness to learn is also noted.
• CIPP/US, CIPM, HCISPP, CISA, CISSP, or AWS/Azure security certifications are a plus.
• Experience with Snyk, Wiz, Qualys, Burp, security-scan remediation, or secrets/certificate rotation is a plus.
• Experience with legal-tech, healthcare, or government SaaS products handling regulated data is a plus.

Benefits and development

• Offers health, retirement, paid time off, and flexible benefits.
• Provides learning opportunities, including an online university, external certifications, LinkedIn Learning, Tech Talks, and hackathons.
• Offers opportunities to share ideas internationally and participate in employee interest forums.
• May offer relocation to an EPAM office for short- or long-term projects.