Staff Cloud Security Engineer

AnswersNowDigital health

Remote, Anywhere in the USFull-TimeStaff

Salary$150K - $215K; $150K – $215K • Offers Equity • Potential to move to W2 full-time

Apply NowOpens the employer's application page

Job Details

Bring 8+ years of security engineering experience.
Have significant hands-on experience securing production cloud environments, ideally AWS-heavy.
Demonstrate deep AWS security expertise, including IAM, networking, encryption/KMS, logging and detection services, and serverless security.
Have experience securing PostgreSQL and other data stores containing regulated or sensitive data.
Bring a strong application and API security background, with the ability to review code and architecture and work effectively with developers.
Have direct experience owning or leading a SOC 2 audit (Type I and/or Type II) and HIPAA compliance, ideally in healthcare or health tech handling PHI.
Have experience with Infrastructure-as-Code (Pulumi, CloudFormation, or CDK) and CI/CD security.
Have experience with AI security, LLM application security, and OWASP LLM Top 10 vulnerabilities.
Bring strong incident response experience.
Nice to have: compliance automation platform experience such as Vanta, Drata, or Secureframe; WebRTC security; or familiarity with HITRUST, ISO 27001, or NIST frameworks.
Relevant certifications such as AWS Security Specialty, CISSP, CCSP, or OSCP are a plus.

Architect, secure, and continuously harden the AWS environment and its cloud infrastructure.
Secure serverless and data layers, including Lambda, S3, and PostgreSQL (RDS/Aurora), and manage EKS infrastructure.
Implement Infrastructure-as-Code security guardrails, policy-as-code, secrets management, key management, and certificate lifecycle controls.
Secure APIs, applications, and the real-time video platform; embed threat modeling, secure design reviews, security testing, and scanning into the SDLC.
Establish AI usage policies and governance, secure AI/ML capabilities, protect sensitive data, and monitor AI/ML workflows.
Own SOC 2 and HIPAA compliance, including audit readiness, evidence collection, risk assessments, policies, and vendor risk management.
Manage endpoint and corporate security, identity and access management, and security awareness and HIPAA training.
Build security logging, monitoring, and alerting; develop and test incident response plans and lead incident response.
Partner with engineering on disaster recovery, backups, and business continuity planning.
Define the security roadmap, communicate risk to leadership, mentor engineers, and build the case for security tools and resources.

View Full Description & ApplyYou'll be redirected to the employer's site