Sr. Information Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Sr. Information Security Engineer based in the United States. This is a senior, hands-on security engineering role focused on protecting cloud-based healthcare SaaS platforms, AI/ML environments, infrastructure, and sensitive customer data. You will design and implement enterprise-grade security controls across cloud, application, identity, endpoint, and AI environments. The role has a particularly strong focus on securing AI and large language model workflows that process protected health information and personally identifiable information. You will collaborate closely with engineering, data science, compliance, legal, and operations teams to embed security throughout the technology lifecycle. The position combines architecture, threat modeling, security automation, incident response, DevSecOps, and regulatory compliance. You will also help shape emerging AI security practices while strengthening defenses against evolving cyber threats. This is an ideal opportunity for a technically strong security professional who enjoys solving complex problems in a highly regulated healthcare technology environment. Accountabilities - Design, implement, and maintain secure architectures across AWS, Azure, and GCP, including infrastructure-as-code and policy-as-code security controls. - Deploy and manage cloud security capabilities such as Security Hub, GuardDuty, Macie, Inspector, Config, Azure Defender for Cloud, and native IAM controls. - Operate CSPM/CNAPP platforms to identify cloud misconfigurations, exposed data stores, toxic combinations, and other security risks. - Secure containerized and serverless environments, including EKS, ECS, Lambda, image scanning, admission controls, runtime protection, and least-privilege access.

- Establish strong network segmentation, encryption, centralized key management, secrets management, and secure workload configurations. - Partner with AI and data teams to secure model development, training, fine-tuning, inference, and retrieval-augmented generation pipelines handling sensitive data. - Apply AI security frameworks and threat-modeling practices to address prompt injection, data poisoning, model exfiltration, insecure outputs, excessive agency, and other AI-specific threats. - Implement AI gateways, guardrails, content filtering, validation, rate limiting, and logging controls while supporting responsible enterprise use of generative AI. - Evaluate third-party and foundation-model providers, including security controls, data residency, retention, contractual protections, and appropriate coverage for sensitive healthcare data. - Secure the machine-learning supply chain through artifact provenance, signed models, dependency scanning, and hardened MLOps environments. - Embed security into CI/CD pipelines through SAST, DAST, SCA, secrets scanning, infrastructure-as-code scanning, threat modeling, and secure design reviews. - Protect APIs and machine-to-machine integrations using secure authorization standards such as OAuth 2. 0, OIDC, mTLS, and scoped service tokens. - Manage software supply-chain security, including SBOMs, dependency governance, artifact signing, penetration testing, vulnerability remediation, and bug-bounty processes. - Strengthen PHI and PII protection through data classification, tokenization, de-identification, DLP, and appropriate access controls. - Manage endpoint and identity security using EDR/XDR, Microsoft Entra ID, Conditional Access, privileged identity management, phishing-resistant MFA, and risk-based authentication. - Govern service accounts, workload identities, service principals, AI agent credentials, and other non-human identities through least privilege and short-lived credentials.