Security Engineer (SOC 2 / HIPAA) | GovTech

Accountabilities:: You will serve as the senior technical owner for platform security, privacy, and compliance controls, turning regulatory and operational requirements into reliable engineering systems. Working alongside the Trust Product Manager and Engineering leadership, your responsibilities will include: Design and implement identity and access management architecture, including authentication, role-based and attribute-based authorization, service identities, and secrets management. Establish secure production access policies, defining approval workflows, permissions, and access controls for engineering teams. Develop and maintain technical documentation and implementation standards in collaboration with the Trust Product Manager. Build isolation mechanisms that protect environments, tenants, workloads, and sensitive data from unauthorized access or exposure. Implement comprehensive audit logging and change-history capabilities that provide verifiable records of system activity for external auditors. Maintain and strengthen SOC 2 Type II and HIPAA technical controls, automating recurring processes such as access reviews and compliance evidence collection. Own the remediation of technical audit findings, coordinating with auditors and ensuring identified issues are resolved effectively. Build secure software delivery workflows through CI/CD pipelines and infrastructure as code, incorporating appropriate production approval mechanisms. Develop reusable security modules and reference implementations that enable engineering teams to adopt security controls consistently. Conduct threat modeling across critical workflows, translating identified risks into actionable engineering requirements and security improvements. Review security-sensitive application code, infrastructure configurations, and architectural changes before deployment. Lead engineering-side incident readiness by establishing logging, detection capabilities, response runbooks, and escalation procedures. Support incident investigations, containment activities, and post-incident improvements while participating in tabletop exercises with product and leadership teams. Collaborate with the Trust Product Manager to translate NIST 800-series requirements into technical controls, implementation priorities, and measurable outcomes. Develop a technical security roadmap supporting state and federal government environments, progressing toward FedRAMP-aligned practices where applicable. Requirements : The ideal candidate is an experienced software engineer with strong security engineering expertise and a proven ability to implement compliance controls directly within production systems. You should be comfortable making architectural decisions independently and translating complex security requirements into practical engineering solutions. Key qualifications include: At least 7 years of software engineering experience, including several years as a senior or lead engineer responsible for production systems. Recent hands-on experience writing and committing application and infrastructure code, ideally within the past 1–2 years. Demonstrated experience implementing and maintaining SOC 2 Type II and HIPAA controls through actual audit cycles. Experience building or operating systems that handle Protected Health Information (PHI). Strong cloud-native production engineering experience, preferably with AWS. Hands-on expertise in infrastructure as code, CI/CD pipelines, approval workflows, and independently configuring production environments. Experience designing and implementing identity and access management systems, including authentication, role-based or attribute-based authorization, service identities, secrets management, production access controls, and audit logging. Practical experience conducting threat modeling and translating findings into implemented security controls. Proven ability to independently resolve audit findings, penetration testing vulnerabilities, or security incidents. Strong understanding of which security controls should be enforced through software versus operational processes. Excellent communication and stakeholder management skills, with the ability to explain technical decisions and trade-offs to engineers, product leaders, and external auditors. Ability to work autonomously in an evolving environment where architecture, processes, and operating models are still being established. Must be based in the United States. Additional experience that would be advantageous includes: Familiarity with NIST 800-53 or other NIST 800-series frameworks and experience translating requirements into actual system changes. Experience with FedRAMP or ISO 27001 compliance initiatives. Experience implementing automated compliance evidence collection or continuous control monitoring accepted by external auditors. Background developing incident response runbooks or leading security tabletop exercises. Production experience working with Node.js, TypeScript, and AWS. Previous experience building software products for government, healthcare, or fintech customers. Benefits : Monthly salary ranging from $14,583 to $17,500 USD, depending on experience and qualifications. Fully remote working arrangement within the United States. Full-time employment through an Employer of Record (EOR). Significant technical ownership, with autonomy over security architecture, engineering decisions, and implementation priorities. Direct collaboration with Product and Engineering leadership. Opportunity to shape security architecture and compliance practices within a small, fast-growing team. Mission-driven work protecting sensitive information belonging to families who depend on public benefit programs. Opportunity to build scalable security systems and influence the technical direction of a growing GovTech platform.