Staff Cloud Security Engineer

AnswersNow Inc•,

9d•$150,000 - $215,000•Remote

About The Position

AnswersNow is seeking a Staff Cloud Security Engineer to serve as its first dedicated security hire and the owner of security across its platform, infrastructure, and corporate environment. The role will set security strategy, build the program, and perform hands-on security work, partnering directly with the CTO and engineering team and serving as a technical authority for customers, auditors, and leadership. The position requires significant autonomy, risk-based decision-making, and leadership in improving the organization’s security maturity. The engineer will secure AnswersNow’s AWS, serverless, database, Kubernetes, application, API, and real-time video environments; embed security practices in development; and establish AI security and governance controls. They will own SOC 2 and HIPAA readiness and compliance, endpoint and corporate security, identity and access management, vulnerability management, monitoring, incident response, and resilience planning. They will also define the security roadmap, communicate risk to executives, mentor engineers, and develop the business case for security investments and future headcount.

Requirements

At least 8 years of experience in security engineering, including significant hands-on experience securing production cloud environments, ideally AWS-heavy.
Deep AWS security expertise, including IAM, networking, encryption/KMS, logging and detection services, and serverless security.
Experience securing PostgreSQL and other data stores containing regulated or sensitive data.
Strong application and API security background, with the ability to review code and architecture and work effectively with developers.
Direct experience owning or leading a SOC 2 audit (Type I and/or Type II) and HIPAA compliance; healthcare or health-tech experience handling PHI is ideal.
Experience with Infrastructure-as-Code such as Pulumi, CloudFormation, or CDK, and CI/CD security.
Experience with AI security, LLM application security, and protection against OWASP LLM Top 10 vulnerabilities.
Strong incident response experience.
Excellent communication skills, including explaining risk to engineers, executives, auditors, and customers.

Nice To Haves

Experience with compliance automation platforms such as Vanta, Drata, or Secureframe.
Experience securing real-time communication or video platforms such as WebRTC.
Familiarity with HITRUST, ISO 27001, or NIST frameworks.
Experience at a startup or scale-up building a security program from scratch.
Relevant certifications such as AWS Security Specialty, CISSP, CCSP, OSCP, or similar.
Experience with pediatric or behavioral health data and the added privacy considerations for minors’ information.

Responsibilities

Architect, secure, and continuously harden the AWS environment, including IAM, VPC design, KMS, CloudTrail, GuardDuty, Security Hub, Config, and WAF.
Secure Lambda, S3, PostgreSQL on RDS/Aurora, and other data layers through encryption, least-privilege access, network isolation, backup integrity, and audit logging.
Implement Infrastructure-as-Code security guardrails and policy-as-code; own secrets management, key management, and certificate lifecycle.
Manage and harden EKS infrastructure, including cluster security, network policies, and container runtime security.
Secure APIs and applications, including authentication and authorization, session management, rate limiting, input validation, and OWASP Top 10 and API Top 10 risks.
Embed security into the SDLC through threat modeling, secure design reviews, SAST/DAST, dependency and container scanning, and CI/CD pipeline security.
Secure the proprietary real-time video platform, including WebRTC/media transport, session access controls, recording storage, and encryption.
Run vulnerability management and penetration testing, including vendor selection, scoping, and remediation tracking.
Establish company-wide AI usage policies and governance frameworks for safe, ethical, and compliant use of internal and third-party AI tools.
Secure in-product AI/ML capabilities against OWASP LLM Top 10 vulnerabilities and prevent unauthorized exposure of PHI/PII in model training, fine-tuning, and prompt contexts.
Define model security controls for artifacts, API endpoints, supply-chain dependencies, and access controls; build monitoring, telemetry, and audit logging across AI/ML workflows.
Own the path to SOC 2 Type I and Type II, including scoping, control design, evidence collection, auditor selection and management, and ongoing readiness.
Own ongoing HIPAA Security Rule compliance, including risk assessments, policies, BAAs, breach notification procedures, and audit readiness.
Tune Vanta integrations, automate evidence collection, and drive remediation of failing tests; maintain the security policy library, risk register, and vendor risk management program.
Support customer and payer security questionnaires and due diligence.
Work with outsourced IT to manage laptop and workstation security, including MDM, disk encryption, EDR, patching, hardening baselines, and device compliance.
Own identity and access management, including SSO, MFA, RBAC, joiner/mover/leaver processes, and periodic access reviews.
Work with People Ops to run security awareness and HIPAA training programs.
Build logging, monitoring, and alerting for platform and corporate environments using a SIEM or equivalent.
Develop and test the incident response plan, run tabletop exercises, and lead incident response.
Partner with engineering on disaster recovery, backup, and business continuity planning.
Define the security roadmap and communicate risk clearly to the CTO and executive team.
Mentor engineers and build a security-conscious culture, such as a security champions model.
Build the business case for security tools, vendors, and eventual additional security headcount.