Senior Security Engineer

EPAM Systems; Argentina; Presencial; ARS 1.200.000 - 2.400.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Healthcare benefits

Paid time off and sick leave

Upskilling and certifications

LinkedIn Learning access

Global career opportunities

Volunteer opportunities

Descripción de la vacante

EPAM Systems in Argentina seeks a Senior Security Engineer who bridges compliance and engineering delivery. You will translate regulatory requirements into concrete technical work, manage evidence collection for audits, and expand the program to additional regulated clients.

You will own end-to-end audit support, map requests to NIST 800-53 controls, coordinate with ISRM, Privacy, Legal, and cloud teams, and build lightweight automation to streamline future audits.

Formación

• 3+ years in security/privacy compliance, GRC, or compliance engineering (HIPAA/FedRAMP/NIST 800-53).
• Knowledge of HIPAA Security & Privacy Rules and NIST 800-53 families (AC, AU, SI, PM).
• Ability to translate compliance language into scoped engineering backlog items using Azure DevOps or Jira.
• Experience supporting third-party audits (SOC 2, FedRAMP, HITRUST) with evidence collection and mapping.
• Experience with cloud environments (AWS GovCloud, Azure Government) and IAM/RBAC, encryption, audit logging, data retention.

Responsabilidades

• Translate regulatory requirements into actionable work items with clear acceptance criteria and owners.
• Track delivery and maintain backlog hygiene across compliance features (access control, data retention, audit logging).
• Write and execute test cases to verify controls (privileged access, SailPoint, PII minimization).
• Own end-to-end audit support including intake, tracking, and fulfillment of auditor requests.
• Produce recurring compliance status reports and build automation like dashboards and pipelines.
• Coordinate across teams (ISRM, Privacy Office, Legal, SRE, cloud teams) to document controls.

Conocimientos

Security compliance

GRC experience

English communication

Cloud security

Herramientas

Azure DevOps

Jira

SailPoint

Descripción del empleo

We are looking for a Senior Security Engineer to join our team. We need an Engineer who can sit at the intersection of compliance/legal requirements and engineering delivery: reading raw regulatory or audit requirements, scoping them into concrete technical work, tracking that work to closure, and running the evidence-collection process for external audits. This program will expand over time to cover additional government and commercial-regulated clients, plus country-specific privacy regimes (UK, EU, Australia, Canada).

Responsibilities

• Translate regulatory and audit requirements into actionable work items by converting HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps Features, Stories, and Tasks with clear acceptance criteria, effort estimates, and a named owner, such as turning "HIPAA privacy requirements not yet defined" into assignable engineering work
• Track delivery progress and maintain backlog hygiene across active compliance features, including access control, data classification, log scrubbing, audit logging, data retention and deletion, and data access restrictions, closing ownership and sprint-assignment gaps before they escal further into RAID-log risks
• Write and execute test cases to verify that controls function as designed, such as privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request, documenting pass/fail evidence throughout
• Own the end-to-end audit support process, including intake, tracking, and fulfillment of third-party auditor evidence requests, such as Schellman FedRAMP Significant Change Reviews, mapping each request to the relevant NIST 800-53 control, coordinating with engineering, ISRM, Privacy, and Legal to gather artifacts, and delivering on the auditor's schedule
• Produce recurring compliance status reporting for stakeholders and build lightweight automation, such as scripts, dashboards, and evidence pipelines, to reduce manual effort in future audit cycles as the program expands to new clients and jurisdictions
• Coordinate across teams, partnering with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document controls inherited from AWS/Azure (FedRAMP, SOC 2) versus controls that must be built and owned internally

Requirements

• A minimum of 3 years of relevant experience in security/privacy compliance, GRC, or compliance engineering, supporting HIPAA and/or FedRAMP/NIST 800-53 programs
• Solid working knowledge of the HIPAA Security & Privacy Rules, including administrative, physical, and technical safeguards, BAAs, breach notification, and minimum necessary standards, along with NIST 800-53 control families such as AC, AU, SI, and PM
• Demonstrated ability to translate compliance and regulatory language into scoped, estimable engineering backlog items using Azure DevOps, Jira, or similar tools
• Direct experience supporting third-party audits, such as SOC 2, FedRAMP, or HITRUST, including evidence collection, control-to-evidence mapping, and meeting auditor deadlines
• Familiarity with cloud environments, such as AWS GovCloud and/or Azure Government, and the controls relevant to compliance, including IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion
• Excellent English communication skills (B2 level or higher)

Nice to have

• Direct experience with FedRAMP Significant Change Requests (SCR) and assessor engagements
• Scripting and automation skills, such as Python or Bash, to automate evidence collection, control testing, or compliance dashboards
• Experience with AWS IAM/identity governance tooling, such as SailPoint or equivalent, and access policy management across S3, RDS, DynamoDB, and Redshift
• Exposure to international privacy regimes, such as UK/EU GDPR, Australia's Privacy Act, or Canada's PIPEDA, or readiness to quickly ramp up as coverage expands
• Relevant certifications, such as CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certification
• Experience with security-scan remediation tracking, using tools such as Snyk, Wiz, Qualys, or Burp, along with experience managing secrets and certificate rotation programs
• Background supporting legal-tech, healthcare, or government SaaS products that handle regulated data

We offer

• International projects with top brands
• Work with global teams of highly skilled, diverse peers
• Healthcare benefits
• Employee financial programs
• Paid time off and sick leave
• Upskilling, reskilling and certification courses
• Unlimited access to the LinkedIn Learning library and 22,000+ courses
• Global career opportunities
• Volunteer and community involvement opportunities
• EPAM Employee Groups
• Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn