Staff Cloud Security Engineer

AnswersNow is a venture-backed digital health company delivering virtual autism care to families. The Staff Cloud Security Engineer will be the first dedicated security hire, owning security strategy and hands-on execution across cloud infrastructure, applications, AI/ML, compliance, corporate systems, detection, and incident response. The role partners with engineering and leadership to strengthen security maturity, achieve SOC 2 and HIPAA compliance, and build a security-conscious culture.

Responsibilities:

• Architect, secure, and continuously harden our AWS environment (IAM, VPC design, KMS, CloudTrail, GuardDuty, Security Hub, Config, WAF, etc.)
• Secure our serverless and data layers, including Lambda, S3, and PostgreSQL (RDS/Aurora): encryption at rest and in transit, least-privilege access, network isolation, backup integrity, and audit logging
• Implement Infrastructure-as-Code security guardrails and policy-as-code
• Own secrets management, key management, and certificate lifecycle
• Manage and harden Amazon Elastic Kubernetes Service (EKS) infrastructure, including cluster security, network policies, and container runtime security
• Secure our APIs and application stack: authentication/authorization, session management, rate limiting, input validation, and OWASP Top 10 / API Top 10 risks
• Embed security into the SDLC with threat modeling, secure design reviews, SAST/DAST, dependency and container scanning, and CI/CD pipeline security
• Secure our proprietary real-time video platform (WebRTC/media transport, session access controls, recording storage, and encryption)
• Run our vulnerability management and penetration testing program, including vendor selection, scoping, and remediation tracking
• Establish company-wide AI usage policies and governance frameworks to ensure safe, ethical, and compliant adoption of internal and third-party AI tools
• Architect and secure in-product AI/ML capabilities, protecting against OWASP LLM Top 10 vulnerabilities (e.g., prompt injection, insecure output handling, data poisoning)
• Implement strict data privacy guardrails to prevent unauthorized exposure of PHI/PII in model training, fine-tuning, and prompt contexts
• Define and enforce model security controls, securing model artifacts, API endpoints, supply chain dependencies, and access controls
• Build continuous monitoring, telemetry, and comprehensive audit logging across all AI/ML workflows to support compliance, threat detection, and incident response
• Own our path to SOC 2 Type I and Type II: scoping, control design, evidence collection, auditor selection and management, and ongoing readiness
• Own ongoing HIPAA Security Rule compliance, including risk assessments, policies, BAAs, breach notification procedures, and audit readiness
• Get the most from Vanta: tune integrations, automate evidence collection, and drive remediation of failing tests
• Maintain the security policy library, risk register, and vendor risk management program
• Support customer and payer security questionnaires and due diligence
• Work with outsourced IT to manage security for laptops and workstations: MDM, disk encryption, EDR, patching, hardening baselines, and device compliance
• Own identity and access management: SSO, MFA, RBAC, joiner/mover/leaver processes, and periodic access reviews
• Work with People ops to run security awareness and HIPAA training programs
• Build logging, monitoring, and alerting for the platform and corporate environment (SIEM or equivalent)
• Develop and test our incident response plan, run tabletop exercises, and lead response when incidents occur
• Partner with engineering on disaster recovery, backup, and business continuity planning
• Define the security roadmap and communicate risk clearly to the CTO and executive team
• Mentor engineers and build a security-conscious culture, such as a security champions model
• Build the business case for tools, vendors, and (eventually) additional security headcount

Requirements:

• 8+ years in security engineering, with significant hands-on experience securing production cloud environments, ideally AWS-heavy
• Deep AWS security expertise (IAM, networking, encryption/KMS, logging and detection services, serverless security)
• Experience securing PostgreSQL and other data stores containing regulated or sensitive data
• Strong application and API security background, and the ability to review code and architecture and work effectively with developers
• Direct experience owning or leading a SOC 2 audit (Type I and/or Type II) and HIPAA compliance, ideally in a healthcare or health-tech environment handling PHI
• Experience with Infrastructure-as-Code (Pulumi, CloudFormation, or CDK) and CI/CD security
• Experience with AI security, LLM application security, and guarding against OWASP LLM Top 10 vulnerabilities
• Strong incident response experience
• Excellent communication: you can explain risk to engineers, executives, auditors, and customers alike
• Experience with compliance automation platforms such as Vanta, Drata, or Secureframe
• Experience securing real-time communication or video platforms (WebRTC)
• Familiarity with HITRUST, ISO 27001, or NIST frameworks
• Experience at a startup or scale-up where you built a security program from scratch
• Relevant certifications (AWS Security Specialty, CISSP, CCSP, OSCP, or similar)
• Experience with pediatric or behavioral health data and the added privacy considerations that come with minors' information