Senior/Lead Security Engineer - HIPPA

EPAM Systems; Hyderabad; On-site; INR 1,800,000 - 2,800,000; Full time

Benefits offered by this job

Health benefits

Retirement benefits

Paid time off

Flexible benefits

Job summary

EPAM Systems, Inc. is seeking a Senior/Lead Security Engineer in Hyderabad to lead HIPAA and FedRAMP/NIST 800-53 compliance efforts.

You will convert regulatory requirements into actionable engineering tasks, manage audit evidence, and coordinate across security, privacy, and legal teams. The role focuses on backlog management for access control, data handling, and logging, with automation to simplify audits and regulatory reporting.

Qualifications

• 6–15 years of IT experience in security/privacy, GRC, or compliance engineering.
• Translate regulatory language into scoped engineering backlog items with clear acceptance criteria.
• Support third-party audits (SOC 2, FedRAMP, or HITRUST) including evidence collection.

Responsibilities

• Convert HIPAA/NIST requirements into Azure DevOps backlog items with defined acceptance criteria.
• Organize backlog across compliance features: access control, data classification, log scrubbing, audit logging, data retention & deletion.
• Develop and execute test cases to verify controls; track pass/fail results.
• Manage evidence requests from auditors and link to controls; coordinate with ISRM, Privacy, and Legal to meet timelines.
• Create automation and dashboards to streamline future audits and reporting.

Skills

HIPAA Compliance

FedRAMP/NIST 800-53

Azure DevOps

Audit & Evidence Mgmt

SailPoint / IAM

Python / Bash

Cloud Platforms (AWS/Azure)

Data Security & Encryption

Security Governance / GRC

Regulatory Translation

Education

Bachelor's in CS/IT or related field

CISSP/CISA/HCISPP/CIPP/US or equivalent

Tools

Azure DevOps

Jira

SailPoint

AWS GovCloud/Azure Government

Snyk/Wiz/Qualys/Burp

Job description

EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting-edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.We're looking for a Senior/Lead Security Engineer to lead HIPAA and FedRAMP/NIST 800-53 compliance efforts, converting regulatory mandates into actionable engineering tasks, supporting third-party audits, and coordinating across security, privacy, and legal functions.ResponsibilitiesConvert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps Features/Stories/Tasks with defined acceptance criteria, effort estimates, and an assigned ownerKeep the backlog organized across active compliance features, covering access control, data classification, log scrubbing, audit logging, data retention & deletion, and data access restrictionsDevelop and run test cases to confirm controls perform as intended, including privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request, and log pass/fail resultsManage the intake, tracking, and completion of third-party auditor evidence requests, including Schellman FedRAMP Significant Change ReviewsLink each audit request to its corresponding NIST 800-53 control and work with engineering, ISRM, Privacy, and Legal to collect artifacts and meet the auditor's timelineGenerate ongoing compliance status reports for stakeholdersDevelop lightweight automation, including scripts, dashboards, and evidence pipelines, to minimize manual work in future audits as the program expands to new clients and jurisdictionsCollaborate with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document which controls are inherited from AWS/Azure and which must be developed or maintained internallyRequirements6-15 years of overall IT experienceBackground in security/privacy compliance, GRC, or compliance engineering, supporting HIPAA and/or FedRAMP/NIST 800-53 programsUnderstanding of HIPAA Security & Privacy Rules, including administrative/physical/technical safeguards, BAAs, breach notification, and minimum necessary standards, along with NIST 800-53 control families such as AC, AU, SI, and PMProven ability to translate compliance/regulatory language into scoped, estimable engineering backlog items using Azure DevOps, Jira, or similar toolsHands-on experience supporting third-party audits such as SOC 2, FedRAMP, or HITRUST, including evidence collection, control-to-evidence mapping, and meeting auditor deadlinesKnowledge of cloud environments such as AWS GovCloud and/or Azure Government, plus controls including IAM/RBAC, encryption/KMS, audit logging, and data retention & deletionNice to haveHands-on experience with FedRAMP Significant Change Requests (SCR) and assessor engagementsScripting/automation skills in Python or Bash for automating evidence collection, control testing, or compliance dashboardsExperience with AWS IAM/identity governance tools such as SailPoint or similar, and access policy management across S3, RDS, DynamoDB, and RedshiftAwareness of international privacy regimes such as UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, or willingness to quickly learn as coverage growsRelevant certifications: CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certificationExperience with security-scan remediation tracking tools such as Snyk, Wiz, Qualys, or Burp, and secrets/certificate rotation programsBackground supporting legal-tech, healthcare, or government SaaS products that handle regulated dataWe offerOpportunity to work on technical challenges that may impact across geographiesVast opportunities for self-development: online university, knowledge sharing opportunities globally, learning opportunities through external certificationsOpportunity to share your ideas on international platformsSponsored Tech Talks & HackathonsUnlimited access to LinkedIn learning solutionsPossibility to relocate to any EPAM office for short and long-term projectsFocused individual developmentBenefit package:Health benefitsRetirement benefitsPaid time offFlexible benefitsForums to explore beyond work passion (CSR, photography, painting, sports, etc.)