Security Architecture Lead – HIPAA, SOC 2 & AWS

Flo Health Inc.; Greater London; Hybrid; GBP 140,000 - 200,000; Full time

Benefits offered by this job

Competitive salary

Performance incentives

Parental leave

Sabbatical

Hybrid work 3 days/week

Flo Premium benefits

Job summary

Flo Health Inc. seeks a Security Architect to lead HIPAA and SOC 2 programs for its AWS multi-account environment, including EKS, Lambda, RDS, S3, VPC, IAM and KMS. You’ll drive the compliance roadmap, partner with auditors, and guide engineering and legal to secure a platform used by millions of users.

You’ll own policy creation, risk management, vendor assessments, and automation of evidence gathering, while collaborating with product and security leadership in a hybrid work model.

Qualifications

• 7+ years in security, compliance or risk management with leadership experience.
• Deep SOC 2 experience in AWS; HIPAA familiarity is a plus.
• Experience handling PHI, GRC tools, and enterprise architecture like TOGAF.
• Ability to manage multiple audit and certification streams.
• Excellent written and verbal communication to translate requirements.

Responsibilities

• Lead annual SOC 2 and HIPAA certifications with auditors and partners.
• Harden AWS workloads and design controls for PHI handling.
• Define security policies, embed risk assessment in engineering processes.
• Support vendor risk reviews and security posture assessments.
• Automate evidence gathering and align with ISO 27001/27701 as needed.
• Serve as security liaison for regulators and cross-functional teams.

Skills

Security leadership

SOC 2 expertise

HIPAA compliance

GRC platforms

TOGAF framework

Audit management

Stakeholder communication

Education

Bachelor's degree in related field

Tools

AWS

EKS

KMS

S3

RDS

Lambda

IAM

Job description

Flo Health Inc. seeks a Security Architect to lead HIPAA and SOC 2 programs for its AWS multi-account environment, including EKS, Lambda, RDS, S3, VPC, IAM and KMS. You’ll drive the compliance roadmap, partner with auditors, and guide engineering and legal to secure a platform used by millions of users.

You’ll own policy creation, risk management, vendor assessments, and automation of evidence gathering, while collaborating with product and security leadership in a hybrid work model.