Principal Security Engineer

47dbbe30-59f3-4be8-90d6-9934bef76b9f•Tampa, FL

1d•Remote

About The Position

The Principal Security Engineer is the organization’s senior technical authority for cloud, application, data, and enterprise security. The role provides strategic leadership and hands-on engineering expertise in support of Avalon's information security, technology, and business objectives. It defines security architecture and engineering standards, identifies and mitigates systemic risk, and leads the design and implementation of enterprise security controls in a predominantly AWS-based healthcare technology environment. The engineer partners with Information Security, Platform Engineering, Cloud Operations, Platform Reliability, Software Engineering, Data Engineering, and Enterprise Architecture to integrate security requirements into technology solutions and operational processes. The role translates regulatory, compliance, and organizational security requirements—including HITRUST and HIPAA—into scalable technical controls for secure, reliable, and compliant operations. As a senior individual contributor and subject matter expert, this role leads complex security initiatives, security-control implementation, and remediation efforts. It provides technical leadership to support secure, resilient, and compliant solutions across the organization. The position is eligible for remote work, with quarterly travel to Avalon’s corporate office in Tampa, Florida.

Requirements

At least 6 years of relevant experience in security engineering, cloud engineering, infrastructure engineering, DevSecOps, or related disciplines.
Significant hands-on experience securing production AWS environments.
Deep understanding of AWS IAM, Organizations, SCPs, VPC networking, KMS, S3, and workload security.
Experience securing EC2, containerized, and serverless workloads.
Strong understanding of network security, identity, encryption, and secrets management.
Experience with infrastructure as code, such as Terraform or CloudFormation.
Experience integrating security controls into CI/CD pipelines.
Strong scripting or software automation capabilities.
Experience with vulnerability management and security remediation.
Experience with security monitoring, logging, and incident investigation.
Ability to independently analyze complex architectures and identify meaningful security risks.

Nice To Haves

Experience operating in healthcare, financial services, or a similarly regulated environment.
Practical experience with HITRUST and HIPAA.
Experience securing Snowflake.
Experience with AWS Security Hub, GuardDuty, CloudTrail, AWS Config, and Control Tower.
Experience with container security involving ECS, Fargate, EKS, or Kubernetes.
Experience with Datadog, SIEM platforms, or enterprise observability systems.
Experience with Harness or comparable CI/CD platforms.
Experience with Tenable, CrowdStrike, or similar vulnerability and endpoint security technologies.
Experience designing multi-account AWS security architectures.
Experience with AWS Backup, immutable storage, and disaster-recovery security controls.
Experience securing Bedrock, generative AI, or self-hosted/open-weight AI models.
Experience developing automated security remediation.
AWS Security Specialty, AWS Solutions Architect Professional, CISM, CISSP, or comparable certifications; beneficial but not required.

Responsibilities

Serve as a senior technical authority for security across a multi-account AWS environment.
Design and maintain security architecture for AWS Organizations, Control Tower, IAM, VPCs, EC2, ECS/Fargate, S3, Lambda, API Gateway, RDS, OpenSearch, Bedrock, and other AWS services.
Establish and improve AWS account, organizational unit, network, workload, and security boundaries.
Design preventative controls using Service Control Policies, IAM policies, permission boundaries, resource policies, and AWS Config controls.
Develop secure patterns for IAM roles, cross-account access, workload identities, and privileged administrative access.
Review cloud architectures and provide practical security guidance during design.
Develop strategies for workload isolation, network segmentation, private connectivity, and controlled internet egress.
Establish security patterns for emerging AI/ML and generative AI workloads.
Build security controls using Terraform and develop reusable security modules, policies, and reference architectures.
Develop automated detection and remediation for common security findings.
Integrate security controls with Snyk into CI/CD and deployment pipelines.
Partner with Platform Reliability and Cloud Operations to incorporate security remediation into normal engineering operations.
Automate evidence collection and technical compliance validation where practical.
Provide senior technical leadership during security incidents and complex investigations.
Improve detection capabilities using AWS Security Hub, GuardDuty, CloudTrail, CloudWatch, Datadog/SIEM, and related telemetry.
Develop security monitoring and alerting standards that emphasize actionable signals.
Provide security architecture and engineering guidance for Snowflake and AWS-hosted data platforms.
Partner with GRC to interpret control requirements technically.
Partner with other Avalon technology principals to audit and evolve technical standards, representing the security perspective.
Mentor and educate the IT organization to improve security knowledge and skills.
Develop security architecture and guardrails for Amazon Bedrock, open-weight models, and other generative AI technologies.
Develop patterns to isolate AI workloads and protect PHI and proprietary information.
Evaluate risks involving model access, prompt or data leakage, third-party model providers, and AI supply chains.
Drive difficult technical problems through investigation, design, implementation, and operational adoption.
Improve engineering teams’ security capabilities through documentation, automation, and reusable patterns.
Remain hands-on while providing organization-level technical leadership.