Senior/Lead Security Engineer - HIPPA

EPAM Systems; Gurugram District; On-site; INR 1,800,000 - 3,000,000; Full time

Benefits offered by this job

Health benefits

Retirement benefits

Paid time off

Flexible benefits

Tech Talks & Hackathons

Relocation to EPAM office

Job summary

EPAM Systems, Inc. seeks a Senior/Lead Security Engineer to lead HIPAA and FedRAMP/NIST 800-53 compliance initiatives. You will translate regulatory findings into Azure DevOps stories, drive audits, and work across security, privacy, and legal teams to meet deadlines.

You will design controls, automate evidence pipelines, and collaborate with AWS/Azure platform teams to implement robust security across regulated data environments.

Qualifications

• 6-15 years of IT experience in security/privacy compliance, including HIPAA and/or FedRAMP/NIST 800-53 programs.
• Ability to convert regulatory language into backlog items with clear acceptance criteria.
• Experience supporting third-party audits and mapping controls to evidence.

Responsibilities

• Convert HIPAA gap analyses and NIST 800-53 controls into Azure DevOps items with owners and estimates.
• Maintain a compliant backlog across access control, data classification, logging, and data deletion.
• Develop and run test cases validating privileged access, data minimization, and deletion-on-request.
• Coordinate evidence requests from auditors and link to NIST/HIPAA controls.

Skills

Security compliance

GRC / compliance engineering

Azure DevOps

Audit support

Scripting (Python/Bash)

IAM / RBAC

Cloud security (AWS/Azure)

Education

Bachelor's degree in IT or related field

Tools

SailPoint

Snyk

Qualys

Job description

EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting-edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.We're looking for a Senior/Lead Security Engineer to lead HIPAA and FedRAMP/NIST 800-53 compliance efforts, turning regulatory requirements into concrete engineering tasks while supporting third-party audits and collaborating across security, privacy, and legal teams.ResponsibilitiesConvert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps Features/Stories/Tasks with defined acceptance criteria, effort estimates, and an assigned ownerKeep the backlog organized across active compliance features, covering access control, data classification, log scrubbing, audit logging, data retention & deletion, and data access restrictionsDevelop and run test cases to confirm controls function as intended, including privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request, and record pass/fail resultsManage the intake, tracking, and completion of evidence requests from third-party auditors, such as Schellman FedRAMP Significant Change ReviewsLink each audit request to its corresponding NIST 800-53 control and work with engineering, ISRM, Privacy, and Legal to collect artifacts and meet auditor deadlinesDeliver regular compliance status updates to stakeholdersCreate lightweight automation—scripts, dashboards, and evidence pipelines—to cut down manual work in future audits as the program expands to new clients and jurisdictionsCollaborate with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document which controls are inherited from AWS/Azure versus those that need to be built or maintained internallyRequirements6-15 years of overall IT experienceBackground in security/privacy compliance, GRC, or compliance engineering, with support for HIPAA and/or FedRAMP/NIST 800-53 programsUnderstanding of the HIPAA Security & Privacy Rules, including administrative/physical/technical safeguards, BAAs, breach notification, and minimum necessary standards, along with NIST 800-53 control families like AC, AU, SI, and PMProven ability to convert compliance/regulatory language into scoped, estimable backlog items using Azure DevOps, Jira, or similar toolsHands-on experience supporting third-party audits such as SOC 2, FedRAMP, or HITRUST, including evidence collection, control-to-evidence mapping, and meeting auditor deadlinesFamiliarity with cloud environments such as AWS GovCloud and/or Azure Government, plus controls like IAM/RBAC, encryption/KMS, audit logging, and data retention & deletionNice to haveHands-on experience with FedRAMP Significant Change Requests (SCR) and assessor engagementsScripting/automation skills in Python or Bash for automating evidence collection, control testing, or compliance dashboardsExperience with AWS IAM/identity governance tools like SailPoint or equivalent, and managing access policies across S3, RDS, DynamoDB, and RedshiftKnowledge of international privacy regimes such as UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, or willingness to quickly learn as coverage growsRelevant certifications: CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certificationExperience with security-scan remediation tracking tools such as Snyk, Wiz, Qualys, or Burp, along with secrets/certificate rotation programsBackground supporting legal-tech, healthcare, or government SaaS products that handle regulated dataWe offerOpportunity to work on technical challenges that may impact across geographiesVast opportunities for self-development: online university, knowledge sharing opportunities globally, learning opportunities through external certificationsOpportunity to share your ideas on international platformsSponsored Tech Talks & HackathonsUnlimited access to LinkedIn learning solutionsPossibility to relocate to any EPAM office for short and long-term projectsFocused individual developmentBenefit package:Health benefitsRetirement benefitsPaid time offFlexible benefitsForums to explore beyond work passion (CSR, photography, painting, sports, etc.)