Senior/Lead Security Engineer - HIPPA

Role overview

Compliance engineering

• Convert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps features, stories, and tasks with acceptance criteria, effort estimates, and owners.
• Maintain a backlog for access control, data classification, log scrubbing, audit logging, data retention and deletion, and data access restrictions.
• Develop and run control tests for privileged access, time-bound SailPoint access, PII minimisation, and deletion on request, documenting pass/fail results.

Audits, reporting, and collaboration

• Manage third-party auditor evidence requests, including intake, tracking, and completion for FedRAMP Significant Change Reviews.
• Map audit requests to NIST 800-53 controls and coordinate evidence collection with engineering, ISRM, Privacy, and Legal to meet auditor timelines.
• Prepare ongoing compliance status reports for stakeholders.
• Create scripts, dashboards, and evidence pipelines to reduce manual audit work as the program expands.
• Work with ISRM, Privacy, Legal, SRE, and cloud platform teams to document inherited AWS/Azure controls and controls maintained internally.

Required qualifications

• 6–15 years of overall IT experience.
• Security/privacy compliance, GRC, or compliance engineering background supporting HIPAA and/or FedRAMP/NIST 800-53 programs.
• Understanding of HIPAA Security and Privacy Rules, including safeguards, BAAs, breach notification, and minimum necessary standards, and NIST 800-53 control families such as AC, AU, SI, and PM.
• Ability to translate regulatory language into scoped engineering backlog items using Azure DevOps, Jira, or similar platforms.
• Hands-on support for third-party audits such as SOC 2, FedRAMP, or HITRUST, including evidence gathering, control mapping, and auditor deadlines.
• Knowledge of AWS GovCloud and/or Azure Government and controls including IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion.

Preferred qualifications

• FedRAMP Significant Change Request and assessor engagement experience is a plus.
• Python or Bash scripting for evidence collection, control testing, or compliance dashboards is a plus.
• SailPoint or equivalent identity governance tools and AWS access-policy experience across S3, RDS, DynamoDB, and Redshift are a plus.
• Knowledge of UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA is a plus; ability to learn expanding coverage is also noted.
• CIPP/US, CIPM, HCISPP, CISA, CISSP, or AWS/Azure security certifications are a plus.
• Snyk, Wiz, Qualys, or Burp remediation tracking and secrets/certificate rotation experience are a plus.

Benefits and development

• Benefits include health, retirement, paid time off, and flexible benefits.
• Development opportunities include online learning, global knowledge sharing, external certifications, tech talks, and hackathons.
• The posting notes the possibility of relocating to an EPAM office for short- or long-term projects.