Senior Security Engineer

Sage Care Inc • Palo Alto, CA

7d • $145,000 - $175,000

About The Position

Sage Care is a fast-growing, early-stage healthcare startup that uses AI to improve care navigation, patient access, quality, and economic outcomes. Founded by leaders from Apple, Uber, and Carbon Health, the company is backed by investors including General Catalyst and Chelsea Clinton, works with health systems across the U.S., and has expanded internationally to the MENA region.

As Sage Care’s first dedicated Security Engineer, you will own security and compliance across its platform, applications, identity systems, and SaaS footprint, and share ownership of the GCP and Kubernetes infrastructure. You will establish security guidelines for engineering teams, implement key controls, and represent the company in discussions with customer security teams. You will report to the Head of Core Platform, Infrastructure and Security, who serves as Sage’s Security Officer and HIPAA Lead.

Requirements

• At least 5 years of experience in security engineering or infrastructure with security ownership.
• Hands-on SOC 2 and HIPAA experience in production environments, using Vanta, Drata, or a similar tool.
• Application security experience, including secure code review, threat modeling, and CI/CD scanning.
• Identity and access management experience with Auth0, Okta, or similar, including SSO and MFA across SaaS.
• Strong GCP or AWS security experience, plus production experience with Kubernetes and Terraform.
• Scripting experience in Python or Go.
• Clear communication with engineers, auditors, and customer security teams, and comfort leading customer-facing reviews.

Nice To Haves

• Healthcare experience handling PHI.
• HITRUST, ISO 27001, or UAE or other international healthcare compliance experience.
• Experience securing LLM or voice AI products.
• Experience as an early or first security hire at a startup.

Responsibilities

• Run the compliance program, including SOC 2 Type II, HIPAA safeguards, risk assessments, vendor BAAs, and penetration-test remediation, using Vanta as the system of record; extend the program to HITRUST and international requirements as the company grows.
• Lead customer security reviews, questionnaires, and audits with hospital IT and security teams in the U.S. and MENA.
• Set engineering security guidelines, including secure design reviews for new services, application security standards, dependency and code scanning, and secrets handling; determine required controls and work with teams to implement them.
• Own identity and access management across Auth0, Google Workspace, SSO, MFA, access reviews, and least privilege across cloud and SaaS systems.
• Build and operate infrastructure with the DevOps team using GCP, GKE, Terraform, and CI/CD, incorporating IAM hardening, network controls, and policy as code.
• Govern protected health information (PHI), including access policy, audit logging, retention, and security reviews of new data flows, including BigQuery.
• Own detection and incident response, including logging, alerting, runbooks, and the breach notification process.
• Secure AI agents by threat-modeling prompt injection, tool misuse, and sensitive data disclosure in voice and LLM workflows.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed