jobapplier

Lead Security Engineer

Flo

Skills

Required

  • SOC 2
  • HIPAA
  • PHI handling
  • GRC
  • compliance automation platforms
  • TOGAF
  • AWS environment
  • CISA / CISM / CISSP
  • DevSecOps
  • Agile development
  • Vendor management

Preferred

  • Internet Security CIS
  • HITRUST
  • building compliance roadmaps
  • containerization
  • Docker / Kubernetes
  • serverless

Join Flo, a leading women's health app, as a Lead Security Engineer. In this role, you will be responsible for designing and operating security controls for US healthcare, ensuring compliance with HIPAA and SOC 2 requirements. You will work closely with product and engineering teams, manage external auditors, and support vendor risk activities. Additionally, you will have the opportunity to participate in Flo's Employee Share Ownership Plan, enjoy generous family benefits, and have access to resources for personal and professional development.

Responsibilities

  • Lead the design and operation of security controls for US Healthcare, translating HIPAA and SOC 2 requirements into technical security controls across Flo's AWS multi-account environment.
  • Own the roadmap for HIPAA compliance and SOC 2 Type II certification, working closely with external auditors and professional services partners, and partnering with Engineering and Legal.
  • Lead annual SOC 2 and HIPAA certifications, managing interfaces with external auditors and professional services, and ensuring compliance with security policies and standards.
  • Strong ability to manage multiple concurrent audit and certification workstreams

Requirements

  • 7+ years in security, compliance, or risk management (3+ in a leadership capacity), with a Bachelor's degree in a related field or equivalent experience
  • Familiarity with PHI handling, GRC and compliance automation platforms, and exposure to enterprise architecture frameworks such as TOGAF
  • Deep expertise in SOC 2 within the AWS environment (familiarity with HIPAA frameworks would be considered a big plus)
  • Excellent written and verbal communication, with the ability to translate complex compliance requirements into clear actions for engineering and business teams
  • CISA, CISM, or CISSP certifications
  • Exposure to DevSecOps and sprint-based Agile development
  • Vendor management experience

Preferred

  • Experience with NIST 800-53, Cloud Security Alliance (CSA), and Center for Internet Security (CIS) frameworks
  • Experience in healthcare or another regulated industry; HITRUST experience a plus
  • Experience building compliance roadmaps in early-stage startups
  • Exposure to containerization (Docker/Kubernetes), serverless, and big data platforms

Pay

USD 100,000 - 130,000