SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 180,000 - 220,000 / annual
Supio is a Series B AI platform purpose-built for law firms, delivering human-level analysis of complex legal data and records. The company has raised $91M in total funding (Series B led by Sapphire Ventures in April 2025) and is headquartered in Seattle with an office in San Francisco. The platform is trusted by top litigation lawyers and has supported over $1 billion in settlements.
You will join Supio's DevOps team as a senior infrastructure engineer with deep security and compliance expertise. This is a hybrid role based in Seattle or San Francisco, with every Tuesday designated as a remote work day.
Key Responsibilities:
- Own Supio's SOC 2, HIPAA, and GDPR compliance programs, scaling audited programs through automated evidence collection, remediations, and continuous control monitoring
- Build and run production infrastructure as a full member of the DevOps team, working with Cloud, Kubernetes, Terraform, CI/CD, and observability systems
- Write production code and build tooling and automation (this role has real software engineering scope, not just scripting)
- Design and maintain identity and access management across cloud, source control, and internal tooling, including least privilege access, access reviews, and auditability
- Identify and remediate CVEs across infrastructure and application code, working directly with engineering teams to close security gaps before they become incidents
You will spend most of your time building and running production infrastructure while owning security and compliance as your area of team scope. This role suits someone who has seen how security and compliance work at scale in a larger organization and wants the autonomy to evolve that function at a fast-growing startup. You'll be energized by the fact that the data you protect (PII and PHI in litigation records) is exactly the kind of data that matters most to get right.
Requirements:
- 5+ years in infrastructure, platform, or SRE engineering with direct ownership of security and compliance work at a large organization with an established program (startup experience is a plus)
- Strong hands-on experience with AWS, Kubernetes, and infrastructure as code (Terraform)
- Ability to write and ship production code, not only scripts
- Hands-on experience taking systems through SOC 2, HIPAA, and GDPR audits from the engineering side
- Proven track record remediating CVEs across both infrastructure and software
- Experience designing and operating IAM and access controls in a cloud environment
- Bachelor's degree in Computer Science or related field, or equivalent practical experience
- Comfortable owning ambiguous, cross-cutting problems with no existing playbook and building processes as you go
- Able to translate security and compliance findings into clear, actionable guidance for engineers who aren't security specialists
Nice-to-haves:
- Hands-on with automated security and compliance tooling (e.g., Vanta, SAST/SCA scanners, policy as code)
- Experience with AI governance frameworks
- Open-source contributions in security or infrastructure
- Background in PII/PHI-heavy industries: medtech, healthtech, legal tech, insurance, or defense/security
