Principal Security Engineer

Imagine Pediatrics•United States (Remote), TX

18h•$195,000 - $225,000

About The Position

Imagine Pediatrics is a technology-enabled, pediatrician-led medical group providing 24/7 virtual-first and in-home medical, behavioral, and social care for children with special health care needs. The Principal Security Engineer will set the technical vision for protecting the organization’s systems and data, serving as a trusted security advisor to the VP, Information Security and partnering across the business to make secure practices the default. The role works closely with Engineering on DevSecOps strategy and architectural improvements while remaining hands-on with complex security challenges and raising the capabilities of the security team and engineers across the organization. The Principal Security Engineer will guide security architecture and strategy across cloud, identity, applications, data, endpoint, email, networks, vulnerability management, and penetration testing. The position will lead security reviews, threat modeling, secure development practices, incident response, and compliance evidence programs. It will shape a multi-year security roadmap, advise leaders on high-stakes security decisions, explore proofs of concept, promote thoughtful AI adoption, and mentor security and engineering colleagues. The role includes participation in an on-call rotation and requires discretion when handling sensitive personal information.

Requirements

10+ years of experience as a Security Engineer, Principal Security Engineer, Security Architect, or in a similar role, including at least 5 years in the healthcare industry.
Track record of setting security technical strategy and driving alignment across security, IT, and engineering teams.
Deep expertise in cloud and identity security architecture across AWS and Microsoft Azure/EntraID.
Hands-on application and product security experience, including threat modeling, secure SDLC and CI/CD design, and securing healthcare APIs such as FHIR and SMART on FHIR.
Experience leading detection and response programs, partnering with MDR providers, and leading technical responses to serious security incidents and data breaches.
Extensive experience translating HITRUST and HIPAA Security Rule requirements into technical controls and supporting auditor, payor, and regulator engagements.
Experience using AI to enhance and automate security processes, and understanding of the security risks AI systems introduce.
Knowledge of IT systems including AWS, Microsoft Intune, EntraID, CrowdStrike Falcon (EDR/SIEM), GitHub Advanced Security, Snowflake, JAMF, Meraki, and JIRA Service Management.
Strong collaboration and coaching skills, with demonstrated success developing senior engineers.
Comfort operating autonomously in ambiguity and exploring early-stage ideas without well-defined requirements.
Experience working in a fast-paced, hypergrowth, collaborative environment.
Willingness to participate in an on-call rotation.
Passion and commitment to reimagining pediatric health care and supporting children with complex medical conditions.

Nice To Haves

Bachelor of Science degree in Computer Science, Information Security, Business, Management, or a related field is desired; an advanced degree is a plus.
Relevant licenses or certifications preferred, such as CISSP, CCSP, CISM, GIAC (e.g., GCIH, GCLD, GSEC), AWS Certified Security – Specialty, or Microsoft Certified: Cybersecurity Architect Expert.
Experience with Medplum.
Contributions to the broader security community, such as conference talks, publications, or industry threat intelligence sharing.

Responsibilities

Set the technical vision for the security stack across endpoint, email, data loss prevention, vulnerability management, penetration testing, network, application, and data security, aligning it with business and clinical strategy.
Define long-term cloud and identity security strategy across Microsoft Azure/EntraID and AWS, including privileged access, phishing-resistant MFA, and governance of non-human identities.
Shape secure infrastructure design patterns that influence company-wide technical decisions.
Lead security architecture reviews and threat modeling for Care Hub and connected services, including Medplum application-layer controls and data platforms such as Snowflake.
Define DevSecOps strategy and standardize security gates across the SDLC and CI/CD pipeline, building on GitHub Advanced Security, OWASP Top 10 practices, software bills of materials, and CISA Known Exploited Vulnerabilities prioritization.
Serve as a senior technical escalation point, including in the on-call rotation, for complex, high-stakes security events.
Strengthen incident playbooks, ransomware and critical-SaaS exercises, and restoration testing against recovery targets.
Monitor and advise on the evolving healthcare threat landscape, including AI-enabled and agentic attacks and their implications for business strategy.
Build documentation and evidence pipelines to demonstrate security posture to payors, regulators, auditors, and other third parties in support of HITRUST, HIPAA, and NIST requirements.
Frame ambiguous, high-stakes security questions and deliver decision-ready recommendations, risk rankings, and documented resolution pathways.
Drive program-level guardrails, including automated configuration checks and drift detection, to prevent misconfigurations systemically.
Shape the technical sequencing of the multi-year security roadmap, contribute to quarterly engineering planning, and align execution with company strategy and business timelines.
Explore early-stage ideas and proofs of concept to de-risk future security initiatives.
Champion thoughtful AI adoption in security and guide secure adoption of AI tools and AI-enabled products across the company.
Partner with engineering, product, IT, and clinical stakeholders to embed security in digital products and translate complex security concepts for non-technical audiences.
Mentor the security engineering team and coach engineers across technology on security craftsmanship and learning.
Advise leadership, advocate for security engineers, align security decisions with business priorities, and demonstrate composure in high-stakes, ambiguous situations.
Use professional discretion and judgment when viewing sensitive and personal data or information.
Perform other duties as assigned.

Benefits

Base salary range of $195,000–$225,000, plus annual bonus incentive.
Competitive company benefits package.
Eligibility to participate in an employee equity purchase program, as applicable.
Competitive medical, dental, and vision insurance.
Healthcare and Dependent Care FSA and a company-funded HSA.
401(k) with 4% match, vested 100% from day one.
Employer-paid short- and long-term disability.
Life insurance at 1x annual salary.
20 days of PTO, 10 company holidays, and 2 floating holidays.
Paid new parent leave.
Additional benefits to be detailed in the offer.