About the role
Lead Security and Compliance Engineer (OpenSpecimen) Scope: 10+ years hands-on engineering role owning Linux infrastructure, AWS security, application hardening, penetration testing, and regulatory compliance frameworks, specifically for OpenSpecimen deployments and healthcare environments.
Responsibilities:
- Cloud and Infrastructure: Configure AWS security controls (IAM, KMS, CloudTrail, GuardDuty, VPC) and harden Linux hosts and container runtimes.
- Application Security: Secure OpenSpecimen web applications and Apache Tomcat configurations; implement encryption at rest and in transit.
- Offensive Security: Execute internal and external penetration tests, vulnerability assessments, and remediation tracking.
- Compliance and Healthcare Security: Manage SOC 2 Type II audit cycles, enforce HIPAA technical safeguards, secure ePHI data pipelines, and complete customer security questionnaires.
Requirements:
- Experience: 10+ years in information security, systems engineering, or DevSecOps, including hands-on security experience in healthcare or health-tech environments.
- Client Exposure: Mandatory experience working directly with US and EU enterprise clients on security, compliance, and audits.
- Technical Skills: Deep Linux administration, mandatory hands-on knowledge of AWS security components (such as CloudTrail, GuardDuty, IAM, and KMS), cryptography implementation, and Tomcat security.
- Security Testing: Practical penetration testing and vulnerability management execution.
- Compliance Knowledge: Direct management of SOC 2 Type II and HIPAA frameworks.