Protect the claim files carriers trust us with. You will build and run the AWS controls behind our SOC 2 Type II, HIPAA and ISO 27001 programs, keep US customer data in US regions, and make sure our Delhi engineering team can operate the platform without standing access to customer claim data. You will report to Priya Venkatesh, CISSP.
What you will do
- Build and maintain security controls in our AWS US regions: IAM, KMS key policies, network segmentation and centralized logging.
- Automate evidence collection for SOC 2 Type II and ISO 27001 audits, and keep HIPAA safeguards current for bodily injury files covered by a BAA.
- Enforce tenant isolation and US-only data residency in infrastructure as code, with policy checks in CI.
- Run just-in-time, approved access for production support, with full session logging.
- Coordinate annual penetration tests and track findings to closure.
- Answer carrier security questionnaires and join customer security reviews with sales and integration teams.
What you bring
- 5+ years in cloud security or security engineering, mostly on AWS.
- Hands-on with IAM, KMS, CloudTrail, GuardDuty, Security Hub and AWS Config.
- Terraform or CloudFormation, plus scripting in Python or Go.
- Experience supporting a SOC 2 Type II or ISO 27001 audit from the engineering side.
- Working knowledge of HIPAA Security Rule safeguards.
- Clear written communication for auditors and customer security teams.
Nice to have
- CISSP, CCSP or AWS Certified Security Specialty.
- Experience securing multi-tenant SaaS that handles regulated data.
- Background at an insurance, healthcare or financial services company.