Cloud Security Compliance Engineer

UnitedHealth Group; Central Visayas; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

UnitedHealth Group's Optum unit seeks a Public Cloud Security Compliance Lead to drive security controls, policy enforcement, and audit readiness across Azure, AWS and GCP. You will partner with engineering and product teams to implement compliant, scalable cloud solutions and lead ongoing assessment efforts.

The role emphasizes cross-functional collaboration, SME-level guidance on standards, and the development of automated processes to support certifications and audits.

Qualifications

• 5 to 7 years of cloud security and compliance experience (PCI DSS SOC 2 HIPAA HiTRUST NIST 800-53).
• 5 to 7 years of healthcare technical operations supporting engineering teams and customers.
• Strong understanding of cloud architecture and ability to interpret logs and configurations.
• Experience with Azure, AWS and GCP security and security tools.
• Experience with SaaS security tools (Palo Alto, Aviatrix, Tenable, Splunk, Github).
• Preferred certifications: CCSP, CISA, CISSP, CSP Security Professional.
• Proficiency in scripting languages (Python, SQL) for automation.

Responsibilities

• Collaborate across Optum engineering, products and business teams to enhance and modernize security and compliance.
• Own and maintain Optum Public Cloud security, audit and compliance responsibilities.
• Ensure cloud environments align with SOC 2, HIPAA, HiTRUST, and NIST 800-53.
• Provide SME support to cloud operations, engineering and product teams.
• Develop and maintain automated/AI-driven compliance processes and documents.
• Participate in audits, attestations and continuous compliance assessments.
• Build and maintain cloud policies aligned to standards and best practices.
• Monitor and support automation initiatives across CSPs.

Skills

Cloud security

Compliance

Multi-cloud security

Automation scripting

Healthcare domain knowledge

Regulatory standards

Automation & tooling

Tools

Defender for Cloud

AWS GuardDuty

GCP Command Center

KMS

Palo Alto

Aviatrix

Tenable

Splunk

Github

Job description

Requisition number: 2384481

Job category: Technology

Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together.

Primary Responsibilities:

• This role is to collaborate across Optum engineering, products and business teams in UHG to enhance and modernize the identified scope of work, own and maintain Optum Public Cloud Security, Audit and Compliance responsibilities.

• Public Cloud - Cloud Compliance Lead

• Compliance Framework: Ensure Optum cloud environments are aligned with regulatory and industry standards such as but not limited to SOC 2, HIPAA, HiTRUST, NIST 800-53, and/or other standards required and approved by Optum.

• Design Consultation : Provide support and consolation as a SME to ensure security and compliance boundary is defined, and control consideration are aligned with applicable compliance standards, Optum policies, security and infrastructure principles.

• Control interpretation: interpret the most current version of the compliance standard consistently and in alignment with industry best practice and Optum practice to establish technical and operational requirements and services.

• Assessment and Validation: Participate and/or perform audit/compliance/security assessment of controls and compliance; including but not limited to perform continues compliance assessments and audit as required; and execute quarterly validation, attestation and reporting as required

• Policy and Procedure: Build and maintain enterprise cloud policies as appropriate for Optum's cloud environment and aligned to applicable standards / best practices.

• Operational and Technical Support : Provide SME support to Public Cloud Operational, Engineering and Product teams to ensure Optum Public Cloud environment meets all policy, statements, control requirements. Overall management of Optum Public Cloud security, audit and compliance posture. Customer consulting / office hours. Monitor and support automation

• Develop and maintain automated / AI driven compliance process and procedures documents that support Optum's compliance certifications and audit.

• Comply with the terms and conditions of the employment contract, company policies and procedures, and any and all directives (such as, but not limited to, transfer and/or re-assignment to different work locations, change in teams and/or work shifts, policies in regards to flexibility of work benefits and/or work environment, alternative work arrangements, and other decisions that may arise due to the changing business environment). The Company may adopt, vary or rescind these policies and directives in its absolute discretion and without any limitation (implied or otherwise) on its ability to do so

Qualifications:

5 to 7 years of cloud Security and compliance experience (PCI DSS SOC 2, HIPAA, HiTRUST, NIST 800-53 etc.)

5 to 7 years of healthcare technical operations (support to engineering teams, support tickets / request from customers, automation etc.)

Strong understanding of cloud architecture and the ability to interpret technical evidence (system logs, configurations).

Functional experience in Azure, AWS and GCP security and security tools (Defender for Cloud, AWS GuardDuty, GCP Command Center, KMS, etc.)

Functional experience with SaaS security tools (Palo Alto, Aviatrix, Tenable, Splunk, Github etc.)

Preferred: Relevant industry certifications like Certified Cloud Security Professional (CCSP), PCI DSS Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), or CSP Security Professional certification.

Proficiency in scripting languages (e.g., Python, SQL) for automation is highly desired.

Metrics:

Reduce duplication and normalized multiple security and compliance standards Timely and accurate responses to audit and compliance requests Build security and compliance pattern across all 3 CSPs for reuse and automation Automate overly burdensome compliance