SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 151,000 - 178,500 / annual
AnswersNow is seeking a Staff Cloud Security Engineer to serve as the first dedicated security hire and single owner of security across the platform, infrastructure, and corporate environment. This is a high-impact, autonomous role reporting to the CTO where you will set security strategy, build the program from the ground up, and execute hands-on security work.
Key Responsibilities:
Cloud & Infrastructure Security: Architect and harden the AWS environment (IAM, VPC, KMS, CloudTrail, GuardDuty, Security Hub, Config, WAF). Secure serverless and data layers including Lambda, S3, and PostgreSQL with encryption, least-privilege access, network isolation, and audit logging. Implement Infrastructure-as-Code security guardrails and policy-as-code. Own secrets management, key management, and certificate lifecycle. Manage and harden Amazon EKS infrastructure including cluster security, network policies, and container runtime security.
Application & API Security: Secure APIs and application stack covering authentication/authorization, session management, rate limiting, input validation, and OWASP Top 10 / API Top 10 risks. Embed security into the SDLC through threat modeling, secure design reviews, SAST/DAST, dependency and container scanning, and CI/CD pipeline security. Secure the proprietary real-time video platform (WebRTC/media transport, session access controls, recording storage, encryption). Run vulnerability management and penetration testing programs.
AI Security & Governance: Establish company-wide AI usage policies and governance frameworks. Architect and secure in-product AI/ML capabilities protecting against OWASP LLM Top 10 vulnerabilities. Implement data privacy guardrails to prevent unauthorized exposure of PHI/PII in model training and prompt contexts. Define and enforce model security controls. Build continuous monitoring and audit logging across AI/ML workflows.
Compliance (SOC 2 & HIPAA): Own the path to SOC 2 Type I and Type II certification including scoping, control design, evidence collection, and auditor management. Own ongoing HIPAA Security Rule compliance including risk assessments, policies, BAAs, and breach notification procedures. Optimize Vanta integrations and drive remediation. Maintain security policy library, risk register, and vendor risk management program. Support customer and payer security questionnaires.
Endpoint & Corporate Security: Manage security for laptops and workstations (MDM, disk encryption, EDR, patching, hardening). Own identity and access management (SSO, MFA, RBAC, joiner/mover/leaver processes). Run security awareness and HIPAA training programs with People Ops.
Detection, Response & Resilience: Build logging, monitoring, and alerting for platform and corporate environment. Develop and test incident response plans, run tabletop exercises, and lead response. Partner on disaster recovery, backup, and business continuity planning.
Leadership: Define the security roadmap and communicate risk to CTO and executive team. Mentor engineers and build security-conscious culture. Build business cases for tools, vendors, and future security headcount.
Requirements:
- 8+ years in security engineering with significant hands-on experience securing production cloud environments, ideally AWS-heavy
- Deep AWS security expertise (IAM, networking, encryption/KMS, logging and detection services, serverless security)
- Experience securing PostgreSQL and other data stores containing regulated or sensitive data
- Strong application and API security background with ability to review code and architecture and work effectively with developers
- Direct experience owning or leading a SOC 2 audit (Type I and/or Type II) and HIPAA compliance, ideally in healthcare or health-tech handling PHI
- Experience with Infrastructure-as-Code (Pulumi, CloudFormation, or CDK) and CI/CD security
- Experience with AI security, LLM application security, and OWASP LLM Top 10 vulnerabilities
- Strong incident response experience
- Excellent communication skills explaining risk to engineers, executives, auditors, and customers
Nice to Have:
- Experience with compliance automation platforms (Vanta, Drata, Secureframe)
- Experience securing real-time communication or video platforms (WebRTC)
- Familiarity with HITRUST, ISO 27001, or NIST frameworks
- Experience at startup or scale-up building security program from scratch
- Relevant certifications (AWS Security Specialty, CISSP, CCSP, OSCP)
- Experience with pediatric or behavioral health data and privacy considerations for minors
