Senior/Lead Security Engineer - HIPPA

EPAM Systems; India; On-site; INR 2,500,000 - 4,200,000; Full time

Job summary

EPAM Systems Inc. in India is seeking a Senior/Lead Security Engineer to drive HIPAA and FedRAMP/NIST 800-53 compliance initiatives and support third-party audits.

You will partner with security, privacy, and legal teams to translate regulatory requirements into concrete engineering tasks and backlog items in Azure DevOps or Jira. The role requires turning gap analyses into scoped work, coordinating evidence collection, and delivering timely status updates while building automation to simplify

Qualifications

• 6-15 years of overall IT experience.
• Background in security/privacy compliance, GRC, or compliance engineering, with HIPAA and/or FedRAMP/NIST 800-53.
• Understanding HIPAA Security/Privacy Rules and NIST 800-53 control families.
• Ability to convert compliance language into scoped, estimable backlog items using Azure DevOps or Jira.
• Experience supporting third-party audits (SOC 2, FedRAMP, HITRUST) and evidence collection.
• Familiarity with AWS GovCloud or Azure Government and IAM/RBAC, encryption, audit logging, data retention.

Responsibilities

• Convert HIPAA gap analyses and NIST controls into Azure DevOps features with acceptance criteria and owners.
• Maintain backlog across compliance features such as access control, data classification, and data retention.
• Develop and run test cases to verify controls, including privileged access restrictions and data deletion.
• Manage evidence requests from auditors and map to NIST controls to meet deadlines.
• Provide regular compliance status updates to stakeholders.
• Create automation, dashboards, and evidence pipelines to streamline future audits.

Skills

Compliance engineering

GRC

Audits

Backlog management

Automation scripting

Cloud security

Regulatory mapping

Tools

Azure DevOps

Jira

SailPoint

Python

Bash

Job description

We're looking for a Senior/Lead Security Engineer to lead HIPAA and FedRAMP/NIST 800-53 compliance efforts, turning regulatory requirements into concrete engineering tasks while supporting third-party audits and collaborating across security, privacy, and legal teams.

Responsibilities

• Convert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps Features/Stories/Tasks with defined acceptance criteria, effort estimates, and an assigned owner
• Keep the backlog organized across active compliance features, covering access control, data classification, log scrubbing, audit logging, data retention & deletion, and data access restrictions
• Develop and run test cases to confirm controls function as intended, including privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request, and record pass/fail results
• Manage the intake, tracking, and completion of evidence requests from third-party auditors, such as Schellman FedRAMP Significant Change Reviews
• Link each audit request to its corresponding NIST 800-53 control and work with engineering, ISRM, Privacy, and Legal to collect artifacts and meet auditor deadlines
• Deliver regular compliance status updates to stakeholders
• Create lightweight automation- scripts, dashboards, and evidence pipelines to cut down manual work in future audits as the program expands to new clients and jurisdictions
• Collaborate with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document which controls are inherited from AWS/Azure versus those that need to be built or maintained internally

Requirements

• 6-15 years of overall IT experience
• Background in security/privacy compliance, GRC, or compliance engineering, with support for HIPAA and/or FedRAMP/NIST 800-53 programs
• Understanding of the HIPAA Security & Privacy Rules, including administrative/physical/technical safeguards, BAAs, breach notification, and minimum necessary standards, along with NIST 800-53 control families like AC, AU, SI, and PM
• Proven ability to convert compliance/regulatory language into scoped, estimable backlog items using Azure DevOps, Jira, or similar tools
• Hands-on experience supporting third-party audits such as SOC 2, FedRAMP, or HITRUST, including evidence collection, control-to-evidence mapping, and meeting auditor deadlines
• Familiarity with cloud environments such as AWS GovCloud and/or Azure Government, plus controls like IAM/RBAC, encryption/KMS, audit logging, and data retention & deletion

Nice to have

• Hands-on experience with FedRAMP Significant Change Requests (SCR) and assessor engagements
• Scripting/automation skills in Python or Bash for automating evidence collection, control testing, or compliance dashboards
• Experience with AWS IAM/identity governance tools like SailPoint or equivalent, and managing access policies across S3, RDS, DynamoDB, and Redshift
• Knowledge of international privacy regimes such as UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, or willingness to quickly learn as coverage grows
• Relevant certifications: CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certification
• Experience with security-scan remediation tracking tools such as Snyk, Wiz, Qualys, or Burp, along with secrets/certificate rotation programs
• Background supporting legal-tech, healthcare, or government SaaS products that handle regulated data