Lead Security Compliance Engineer
New
E
EPAMSecurity compliance
Opportunity to work remotely within PolandFull-TimeLead
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Languages
- English proficiency at B2 level or higher
- Experience
- 3+ years of experience in security/privacy compliance, GRC, or compliance engineering, supporting HIPAA and/or FedRAMP/NIST 800-53 programs
- Required Skills
- PythonAzure DevOpsHIPAA
Requirements
- Have 3+ years of experience in security/privacy compliance, GRC, or compliance engineering supporting HIPAA and/or FedRAMP/NIST 800-53 programs.
- Have working knowledge of HIPAA Security and Privacy Rules, including safeguards, BAAs, breach notification, and minimum necessary standards.
- Know NIST 800-53 control families, including AC, AU, SI, and PM.
- Be able to translate regulatory requirements into scoped, estimable engineering backlog items using Azure DevOps, Jira, or similar tools.
- Have experience supporting third-party audits such as SOC 2, FedRAMP, or HITRUST, including evidence collection and control-to-evidence mapping.
- Be familiar with cloud environments such as AWS GovCloud and/or Azure Government.
- Understand compliance controls including IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion.
- Have English proficiency at B2 level or higher.
- Scripting or automation experience with Python or Bash is a plus.
- Experience with FedRAMP Significant Change Requests, SailPoint or equivalent identity governance tooling, or security-scan remediation tools is a plus.
Responsibilities
- Convert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into Azure DevOps Features, Stories, and Tasks with acceptance criteria, estimates, and owners.
- Maintain compliance backlogs covering access control, data classification, log scrubbing, audit logging, data retention and deletion, and data access restrictions.
- Resolve ownership and sprint-assignment gaps before they become RAID-log risks.
- Write and execute tests for controls such as privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request.
- Document pass/fail evidence for control testing.
- Manage third-party auditor evidence requests, including Schellman FedRAMP Significant Change Reviews.
- Map auditor requests to NIST 800-53 controls and coordinate artifact collection with engineering, ISRM, Privacy, and Legal.
- Deliver evidence and documentation to auditor schedules and produce recurring compliance status reports.
- Build scripts, dashboards, and evidence pipelines to reduce manual effort in future audit cycles.
- Partner with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document inherited AWS/Azure controls and internally owned controls.
View Full Description & ApplyYou'll be redirected to the employer's site
