Senior Security Engineer

Sage Care • Palo Alto, CA

3d

About The Position

Sage Care is a fast-growing, early-stage healthcare startup using AI to improve care navigation, access, quality, and economic outcomes. Its platform serves health systems across the United States and has expanded internationally to the MENA region.

As Sage Care’s first dedicated Security Engineer, you will own security and compliance across the platform, applications, identity, and SaaS footprint, while sharing responsibility for the GCP and Kubernetes infrastructure with the DevOps team. You will establish security guidelines for engineering teams, implement key controls, and represent the company in discussions with customer security teams. The role reports to the Head of Core Platform, Infrastructure and Security, who serves as Sage’s Security Officer and HIPAA Lead.

Requirements

• At least 5 years of experience in security engineering or infrastructure with security ownership.
• Hands-on SOC 2 and HIPAA experience in production environments, using Vanta, Drata, or a similar tool.
• Application security experience, including secure code review, threat modeling, and CI/CD scanning.
• Identity and access management experience with Auth0, Okta, or similar, and SSO/MFA across SaaS.
• Strong GCP or AWS security experience, plus production experience with Kubernetes and Terraform.
• Scripting experience in Python or Go.
• Clear communication with engineers, auditors, and customer security teams, and comfort leading customer-facing reviews.

Nice To Haves

• Healthcare experience handling PHI.
• HITRUST, ISO 27001, or UAE or other international healthcare compliance experience.
• Experience securing LLM or voice AI products.
• Experience as an early or first security hire at a startup.

Responsibilities

• Run the compliance program, including SOC 2 Type II, HIPAA safeguards, risk assessments, vendor BAAs, and penetration-test remediation, using Vanta as the system of record.
• Extend the compliance program to HITRUST and international requirements as the company grows.
• Lead customer security reviews, questionnaires, and audits with hospital IT and security teams across customers in the U.S. and MENA.
• Set engineering security guidelines, including secure design reviews for new services, application security standards, dependency and code scanning, and secrets handling; determine required work and coordinate its completion with teams.
• Own identity and access management across Auth0, Google Workspace, SSO, MFA, access reviews, and least privilege across cloud and SaaS.
• Build and operate infrastructure alongside the DevOps team using GCP, GKE, Terraform, and CI/CD, incorporating IAM hardening, network controls, and policy as code.
• Govern protected health information (PHI), including access policy, audit logging, retention, and security reviews of new data flows, including BigQuery.
• Own detection and incident response, including logging, alerting, runbooks, and the breach notification process.
• Secure AI agents by threat-modeling prompt injection, tool misuse, and sensitive-data disclosure in voice and LLM workflows.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed