- Cloud and Infrastructure Security: Architect, implement, and continuously improve security across AWS infrastructure, including IAM, VPC networking, KMS, CloudTrail, GuardDuty, Security Hub, AWS Config, and WAF. Secure serverless services, databases, storage, and containerized workloads through encryption, network isolation, least-privilege access, reliable backups, and comprehensive audit logging.
- Infrastructure-as-Code and Platform Protection: Establish security guardrails and policy-as-code for infrastructure provisioning. Manage secrets, encryption keys, and certificates, and harden Amazon EKS clusters through appropriate access controls, network policies, and container runtime protections.
- Application and API Security: Secure application architecture and APIs by implementing strong authentication and authorization, session management, rate limiting, input validation, and protections against OWASP Top 10 and API security risks. Integrate threat modeling, secure design reviews, static and dynamic application security testing, dependency scanning, container scanning, and CI/CD security controls into the software development lifecycle.
- Real-Time Communication Security: Protect proprietary video and communication systems, including WebRTC and media transport, session access controls, recording storage, and encryption throughout data transmission and storage.
- AI Security and Governance: Develop organization-wide AI usage policies and governance frameworks that support secure, responsible, and compliant adoption of internal and third-party AI tools. Protect AI/ML applications against vulnerabilities such as prompt injection, insecure output handling, and data poisoning, while establishing safeguards against unauthorized exposure of protected health information (PHI) and personally identifiable information (PII).
- AI/ML Security Monitoring: Define and enforce security controls for models, artifacts, APIs, supply chain dependencies, and access permissions. Implement continuous monitoring, telemetry, and audit logging across AI/ML workflows to support compliance, threat detection, and incident response.
- Compliance and Audit Management: Lead the organization's SOC 2 Type I and Type II compliance efforts, including scoping, control design, evidence collection, auditor coordination, and ongoing readiness. Own HIPAA Security Rule compliance, including risk assessments, policies, business associate agreements (BAAs), breach notification procedures, and audit preparation.
- Security Compliance Automation: Optimize the use of compliance automation platforms such as Vanta to streamline evidence collection, improve control monitoring, and resolve failing compliance checks. Maintain security policies, the risk register, and vendor risk management processes, and support customer and payer security assessments.
- Endpoint and Corporate Security: Partner with outsourced IT providers to secure employee laptops and workstations through device management, encryption, endpoint detection and response (EDR), patching, and security baselines. Own identity and access management, including SSO, MFA, role-based access control, employee lifecycle processes, and periodic access reviews.
- Security Awareness and Training: Collaborate with People Operations to deliver security awareness and HIPAA training, reinforcing secure working practices across the organization.
- Detection, Incident Response, and Resilience: Establish logging, monitoring, and alerting capabilities across cloud, application, and corporate environments. Develop, maintain, and test incident response procedures, lead security incident response when needed, and conduct tabletop exercises. Partner with engineering to strengthen disaster recovery, backup integrity, and business continuity planning.
- Security Strategy and Technical Leadership: Define the security roadmap, prioritize initiatives according to risk and business impact, and communicate security posture and trade-offs clearly to the CTO and executive leadership. Mentor engineers, promote security champions, build a security-conscious culture, and develop business cases for security tools, external partners, and future team expansion.
Requirements
- Professional Experience: At least 8 years of experience in security engineering, including substantial hands-on responsibility for securing production cloud environments, preferably with a strong AWS focus.
- AWS Security Expertise: Deep knowledge of AWS security architecture, including IAM, network security, encryption and KMS, logging and threat detection services, serverless security, and cloud infrastructure hardening.
- Sensitive Data Protection: Experience securing PostgreSQL and other data stores that contain regulated, confidential, or otherwise sensitive information.
- Application and API Security: Strong understanding of application security principles, API protection, secure architecture, and common software vulnerabilities, with the ability to review code and collaborate effectively with software engineers.
- Compliance Ownership: Direct experience leading or owning SOC 2 Type I and/or Type II audits and HIPAA compliance initiatives. Experience in healthcare or health technology environments handling PHI is highly desirable.
- Infrastructure Automation: Practical experience implementing Infrastructure-as-Code security controls using tools such as Pulumi, AWS CloudFormation, or AWS CDK, along with CI/CD security practices.
- AI and LLM Security: Experience securing AI-powered applications and large language model systems, including awareness of OWASP LLM Top 10 vulnerabilities, data privacy risks, and model access controls.
- Incident Response: Strong experience identifying, investigating, containing, and resolving security incidents, as well as developing effective monitoring and response procedures.
- Leadership and Communication: Excellent communication skills, with the ability to explain technical vulnerabilities, compliance obligations, and risk-based decisions to engineers, executives, auditors, and customers.
- Autonomy and Strategic Judgment: Demonstrated ability to work independently, establish priorities, make sound risk-based trade-offs, and develop security programs that support organizational growth.
- Compliance Automation Experience: Familiarity with platforms such as Vanta, Drata, or Secureframe is an advantage.
- Specialized Security Knowledge: Experience securing real-time communication or video platforms, including WebRTC, is beneficial. Familiarity with HITRUST, ISO 27001, or NIST frameworks is also desirable.
- Startup Experience: Previous experience building a security program from the ground up within a startup or scale-up environment is a plus.
- Certifications: Relevant credentials such as AWS Certified Security – Specialty, CISSP, CCSP, OSCP, or equivalent certifications are advantageous.
- Healthcare Privacy: Experience handling pediatric or behavioral health data, particularly the additional privacy considerations associated with minors' information, is a plus.
- Remote Work Readiness: Ability to collaborate effectively with a distributed team while maintaining accountability, clear communication, and consistent delivery.
Benefits
- Competitive Compensation: The job posting lists a salary range of $151,000–$178,500 annually. The advertised compensation section also references a broader range of $150,000–$215,000; final compensation should be confirmed with the hiring team.
- Equity Opportunities: Eligibility for equity options in a high-growth, venture-backed digital health organization.
- Comprehensive Healthcare: Medical, dental, and vision insurance coverage.
- Generous Paid Time Off: Paid leave designed to support work-life balance and personal well-being.
- Remote-First Flexibility: The ability to work remotely from anywhere in the United States.
- Professional Impact: The opportunity to establish and lead a security function, influence technical architecture, and shape organization-wide security standards.
- Technical Ownership: Broad responsibility across cloud security, application protection, AI governance, compliance, and incident response.
- Leadership Development: Direct collaboration with executive leadership and engineering teams, with opportunities to influence security strategy and future team growth.
- Meaningful Mission: Contribute to protecting sensitive healthcare information and supporting the secure delivery of virtual autism care to families.