Senior Security Engineer

Rezilient Health

10d

About The Position

Rezilient is seeking a hands-on senior individual contributor to support its information security programs and protect the systems, data, and infrastructure that power its CloudClinic model. The role focuses particularly on protecting protected health information (PHI) and personally identifiable information (PII) across cloud platforms, clinical environments, and corporate systems. The Senior Security Engineer designs, builds, and operates technical security controls spanning cloud and application security, identity and access management, endpoint protection, detection, and incident response. In partnership with Engineering, Product, IT, Clinical Operations, and the Security & Compliance team, the engineer embeds security into how the company builds and operates its platform and provides technical evidence and expertise for SOC 2, HIPAA/HITECH, HITRUST, and related frameworks. This role combines architecture and execution. The engineer is expected to bring deep technical expertise and sound judgment, translate security needs into practical solutions, and help a fast-moving healthcare technology company grow safely. The position also contributes to the security roadmap, automation, security culture, and technical mentorship as the function grows.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience.
At least 5 years of experience in information security, security engineering, or a closely related technical role.
Deep hands-on experience securing AWS cloud environments, including IAM, networking, encryption, logging, and cloud-native security services.
Strong application security background, including threat modeling, secure code review, and security testing tools in CI/CD pipelines.
Experience with identity and access management, endpoint security, and security monitoring or SIEM tools.
Proven experience leading or supporting incident response and vulnerability management programs.
Working knowledge of frameworks such as SOC 2, HIPAA/HITECH, HITRUST, ISO 27001/27002, or NIST CSF, and experience providing technical evidence for audits.
Proficiency in scripting or programming, such as Python, Go, or Bash, and experience with infrastructure as code, such as Terraform.
Excellent communication skills and ability to explain technical risks to technical and non-technical audiences.
Comfort operating as a senior individual contributor with broad ownership in a fast-moving startup environment.

Nice To Haves

Experience in healthcare, digital health, or SaaS/cloud environments.
Experience protecting PHI or other regulated data.
Certifications such as CISSP, CCSP, OSCP, GIAC certifications (e.g., GCIH, GCLD, GWAPT), or cloud security certifications.

Responsibilities

Design, implement, and maintain security controls across cloud infrastructure, including network security, encryption, secrets management, logging, and configuration hardening.
Build and manage security guardrails using infrastructure as code, cloud-native security tools, and automated policy enforcement.
Assess cloud environments for misconfigurations, excessive permissions, and exposure risks, and drive remediation with Engineering.
Protect PHI and PII at rest and in transit through appropriate data classification, access restrictions, and retention controls.
Partner with Product and Engineering to embed security throughout the software development lifecycle, from design through release.
Lead threat modeling and security design reviews for features, integrations, infrastructure, and architecture decisions.
Own application security tooling and processes, including static and dynamic analysis, dependency and container scanning, and secure code review.
Establish secure development standards and coach engineers on secure coding practices and common vulnerability classes.
Assess the security of third-party integrations, APIs, and EHR and partner data exchanges that handle patient data.
Partner with IT to design and enforce identity and access management controls, including SSO, MFA, role-based access, least privilege, and access reviews.
Build and tune security monitoring, logging, and alerting across cloud, application, identity, and endpoint layers.
Serve as a technical lead during security incidents, coordinating investigation, containment, eradication, recovery, and post-incident review.
Develop and maintain incident response runbooks and lead tabletop exercises with cross-functional teams.
Own vulnerability management, including scanning, prioritization, remediation tracking, and coordination of penetration tests.
Monitor the threat landscape relevant to healthcare and cloud environments and adapt defenses proactively.
Produce technical-control evidence for SOC 2, HIPAA/HITECH, HITRUST, and related frameworks.
Support audits, risk assessments, and remediation efforts through technical expertise, documentation, and control testing.
Contribute to security policies, standards, and procedures, ensuring they are technically sound and practical to operate.
Advise Engineering, Product, IT, and leadership by translating technical risk into business impact and recommendations.
Automate security processes and reduce manual work through scripting, tooling, and integration.
Contribute practical, role-specific security awareness guidance for engineers and staff.
Help shape the long-term information security roadmap and mentor team members as the security function grows.

Benefits

Stock options and meaningful ownership.
Competitive base compensation.
Medical, dental, and vision coverage options, with Rezilient contributing toward premiums.
Complimentary access to Rezilient clinical programs for the employee and household members.
401(k) retirement plan.
Flexible Paid Time Off.
Dedicated paid sick leave separate from Flexible Paid Time Off.
11 paid company holidays each year.
Paid family leave.
Optional ancillary benefits, including life insurance, disability coverage, and a Health Savings Account (HSA).