Lead Security Engineer (US-Remote)

About This Role

Handl Health is a post-Series A healthcare technology company building AI-powered care navigation and cost estimation products. 

We're hiring our first full-time Lead Security Engineer to take full ownership of our security and compliance program. We're SOC 2 certified and HIPAA compliant, with security and compliance currently shared across engineering and ops. As we scale, these functions need a dedicated owner who can mature the program, deepen our operational practices, and let us keep moving fast without accumulating risk.

This is an engineering-first, hands-on role, not a managerial or advisory one. It splits roughly evenly between compliance and GRC on one side and technical security engineering on the other. 

You'll own outcomes, not just recommendations, and you'll spend real time in the weeds: reviewing IAM policies, threat modeling PHI-bearing services, and building the tooling and knowledge base that keep the program running without constant manual effort.

What You'll Do

• Own the end-to-end security and compliance posture, including HIPAA, SOC 2, and vendor risk management, as the accountable party for audit cycles from scoping through evidence and auditor management.
• Build and maintain a living, AI-enabled compliance knowledge base so evidence and control mappings are queryable and current, not reconstructed under audit pressure.
• Own the BAA lifecycle with customers and vendors.
• Conduct regular security assessments of our infrastructure (AWS, S3 data lake, AI integrations) and build a prioritized remediation roadmap.
• Threat model our PHI-bearing services and drive remediation, with hands-on review of IAM, network boundaries, S3 access patterns, encryption, and logging.
• Establish and maintain security policies, incident response procedures, and access control frameworks.
• Own security tooling and automation, including detection, alerting, and evidence-collection pipelines you build yourself, leveraging AI to streamline manual processes where appropriate.
• Evaluate and manage risk across our evolving AI toolchain, including enterprise LLM platforms, MCP integrations, and third-party connectors (Slack, Gmail, Google Drive).
• Own DLP strategy for our data lake, including PHI quarantine architecture and access controls.
• Manage our JAMF instance and endpoint security across the organization.
• Partner with engineering on secure SDLC: branch protection, risk gating, dependency and secrets management.
• Lead security reviews for new product features and AI capabilities before they ship.
• Interface with customers and partners on security questionnaires, audits, and compliance requirements.
• Build the security culture: training, awareness, and lightweight processes that engineers actually follow.

What You Bring

• 6+ years in software or infrastructure engineering, with 2+ years focused on security and experience owning a security or compliance program end-to-end.
• Deep SOC 2 experience: You've personally owned and managed SOC 2 audits end-to-end, ideally Type II, as the accountable owner rather than a contributor.
• Hands-on knowledge of AWS security (IAM Identity Center, S3 policies, CloudTrail, GuardDuty). You can read a policy document and a Terraform/Pulumi diff and know what's wrong with both.
• Ability to build tooling and automation yourself. You're comfortable writing code and scripting against APIs to eliminate manual compliance toil.
• Practical, hands-on experience using AI tools in engineering or security workflows. You're actively experimenting with and applying AI to improve how work gets done, and can think critically about AI/LLM security risks, including prompt injection, data exfiltration, model safety, and supply-chain risks.
• Track record of building security programs at startups or growth-stage companies, not just maintaining them at large enterprises.
• Strong written communication. Much of this role is producing clear, defensible documentation for auditors and customers.

Nice to Have

• Experience with HIPAA compliance and securing systems that handle PHI.
• Experience with PHI de-identification and handling in ML/AI pipelines.
• Familiarity with healthcare payer or TPA ecosystems.
• Background in securing API products and B2B data integrations.

Compensation

The base salary range for this position is $185,000-$215,000, depending on your location, experience, and market conditions

Benefits you'll receive: 

• Employee Stock Options 
• Generous health benefits and 401K matching 
• Flexible paid vacation, parental and medical leave 
• A stipend to help you set up a home office 

Why Handl Health

• High-impact role where your work directly protects patients' data and supports the company as it scales.
• Own an established security and compliance program with the mandate to mature and deepen it, with direct ownership and executive visibility.
• Work alongside a technical leadership team that takes security seriously.
• Post-Series A company with the resources to invest in security properly.
  

Handl Health is an equal opportunity employer. We evaluate candidates on demonstrated ability and do not discriminate on any protected basis.