Senior/Lead Security Engineer - HIPPA

EPAM Systems; Pune District; On-site; INR 2,500,000 - 4,200,000; Full time

Benefits offered by this job

Health benefits

Retirement benefits

Paid time off

Flexible benefits

Job summary

EPAM Systems, Inc. is seeking a Senior/Lead Security Engineer in Pune to lead HIPAA and FedRAMP/NIST 800-53 compliance efforts. You will convert regulatory mandates into engineering tasks, manage third-party audits, and collaborate across security, privacy, and legal functions.

You will develop and run test cases, automate evidence pipelines, and produce status reports for stakeholders, while coordinating with cloud platform teams to implement inherited versus internal controls.

Qualifications

• Must translate compliance language into engineering backlog items with estimable effort.
• Experience supporting third-party audits (SOC 2, FedRAMP, HITRUST) and gathering evidence.
• Knowledge of HIPAA Security & Privacy Rules and NIST 800-53 control families (AC, AU, SI, PM).

Responsibilities

• Convert HIPAA gap analyses, NIST controls, and audit findings into Azure DevOps features/tasks with clear acceptance criteria and estimates.
• Keep compliance backlog organized across access control, data retention/deletion, and audit logging.
• Develop and run test cases to verify controls (privilege restrictions, time-based access, PII minimization).
• Manage evidence requests from auditors and link to controls for timely responses.
• Generate ongoing compliance status reports for stakeholders.
• Create automation scripts/dashboards to reduce manual audit work as programs scale.

Skills

HIPAA compliance

FedRAMP/NIST 800-53

Azure DevOps

Jira

Audit support

Scripting (Python/Bash)

IAM/RBAC

Cloud (AWS/Azure)

Tools

SailPoint

Snyk

Qualys

Burp

Job description

EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting-edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.We're looking for a Senior/Lead Security Engineer to lead HIPAA and FedRAMP/NIST 800-53 compliance efforts, converting regulatory mandates into concrete engineering tasks while facilitating third-party audits and collaborating across security, privacy, and legal functions.ResponsibilitiesConvert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps Features/Stories/Tasks with defined acceptance criteria, effort estimates, and a designated ownerKeep the backlog organized across ongoing compliance features, including access control, data classification, log scrubbing, audit logging, data retention & deletion, and data access restrictionsDevelop and run test cases to confirm controls function as intended, such as privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request, then document pass/fail resultsManage the intake, tracking, and completion of third-party auditor evidence requests, such as Schellman FedRAMP Significant Change ReviewsLink each audit request to its corresponding NIST 800-53 control and work with engineering, ISRM, Privacy, and Legal to collect artifacts and meet the auditor's timelineGenerate ongoing compliance status reports for stakeholdersCreate simple automation tools, such as scripts, dashboards, and evidence pipelines, to cut down manual work in future audits as the program expands to new clients and jurisdictionsCollaborate with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document which controls are inherited from AWS/Azure versus those that must be developed or maintained internallyRequirements6-15 years of overall IT experienceBackground in security/privacy compliance, GRC, or compliance engineering, with support for HIPAA and/or FedRAMP/NIST 800-53 programsUnderstanding of the HIPAA Security & Privacy Rules, covering administrative/physical/technical safeguards, BAAs, breach notification, and minimum necessary standards, along with NIST 800-53 control families such as AC, AU, SI, and PMProven ability to convert compliance/regulatory language into scoped, estimable engineering backlog items using Azure DevOps, Jira, or similar platformsHands-on experience supporting third-party audits such as SOC 2, FedRAMP, or HITRUST, including gathering evidence, mapping controls to evidence, and meeting auditor deadlinesKnowledge of cloud environments such as AWS GovCloud and/or Azure Government, plus controls including IAM/RBAC, encryption/KMS, audit logging, and data retention & deletionNice to haveHands-on experience with FedRAMP Significant Change Requests (SCR) and assessor engagementsScripting/automation skills using Python or Bash to automate evidence collection, control testing, or compliance dashboardsExperience with AWS IAM/identity governance tools such as SailPoint or equivalent, and managing access policies across S3, RDS, DynamoDB, and RedshiftUnderstanding of international privacy regimes such as UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, or the ability to quickly learn as coverage expandsRelevant certifications: CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certificationExperience with security-scan remediation tracking tools such as Snyk, Wiz, Qualys, or Burp, along with secrets/certificate rotation programsBackground supporting legal-tech, healthcare, or government SaaS products that handle regulated dataWe offerOpportunity to work on technical challenges that may impact across geographiesVast opportunities for self-development: online university, knowledge sharing opportunities globally, learning opportunities through external certificationsOpportunity to share your ideas on international platformsSponsored Tech Talks & HackathonsUnlimited access to LinkedIn learning solutionsPossibility to relocate to any EPAM office for short and long-term projectsFocused individual developmentBenefit package:Health benefitsRetirement benefitsPaid time offFlexible benefitsForums to explore beyond work passion (CSR, photography, painting, sports, etc.)