We are hiring a Lead Security Engineer to drive HIPAA and FedRAMP/NIST 800-53 compliance by turning regulatory mandates into engineering work. You will partner with Security, Privacy, and Legal to prepare for and support third-party audits, including SOC 2 and FedRAMP efforts. Apply to help keep compliance execution predictable and audit-ready

Responsibilities

Translate HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into Azure DevOps Features/Stories/Tasks with clear acceptance criteria, estimates, and an assigned owner
Maintain an organized backlog across compliance initiatives such as access control, data classification, log scrubbing, audit logging, data retention & deletion, and data access restrictions
Design and execute test cases to validate controls (for example privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request) and record pass/fail outcomes
Coordinate intake, tracking, and closure of auditor evidence requests, including items like Schellman FedRAMP Significant Change Reviews
Map each audit request to the relevant NIST 800-53 control and partner with engineering, ISRM, Privacy, and Legal to collect artifacts and hit auditor timelines
Produce recurring compliance status updates for internal stakeholders
Build lightweight automation such as scripts, dashboards, and evidence pipelines to reduce manual work as audits expand to new clients and jurisdictions
Collaborate with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document which controls are inherited from AWS/Azure versus maintained or built internally

Requirements

Extensive IT experience with 5+ years in professional roles
Solid background in security/privacy compliance, GRC, or compliance engineering, supporting HIPAA and/or FedRAMP/NIST 800-53 programs
Deep understanding of HIPAA Security & Privacy Rules, including administrative/physical/technical safeguards, BAAs, breach notification, and minimum necessary standards, plus NIST 800-53 families such as AC, AU, SI, and PM
Proven track record translating compliance and regulatory language into scoped, estimable backlog items in Azure DevOps, Jira, or similar tools
Hands-on experience supporting third-party audits such as SOC 2, FedRAMP, or HITRUST, including evidence gathering, control-to-evidence mapping, and meeting auditor deadlines
Working knowledge of cloud environments like AWS GovCloud and/or Azure Government, including IAM/RBAC, encryption/KMS, audit logging, and data retention & deletion controls

Nice to have

Direct experience with FedRAMP Significant Change Requests (SCR) and assessor interactions
Python or Bash scripting to automate evidence collection, control testing, or compliance dashboards
Experience with AWS IAM/identity governance tools such as SailPoint (or equivalent) and managing access policies across S3, RDS, DynamoDB, and Redshift
Familiarity with international privacy regimes such as UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, or ability to ramp up quickly as coverage expands
Relevant certifications such as CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certification
Experience tracking security-scan remediation with tools like Snyk, Wiz, Qualys, or Burp, plus secrets/certificate rotation programs
Background supporting legal-tech, healthcare, or government SaaS products handling regulated data