Lead Security Compliance Engineer

EPAM Systems; Polska; Hybrid; PLN 120,000 - 180,000; Full time

Benefits offered by this job

Hybrid work in Poland

English classes

Employee stock purchase plan

Relocation opportunities

Health insurance

Job summary

EPAM Systems, Inc. is seeking a Lead Security Compliance Engineer to translate regulatory requirements into actionable engineering work, drive audit readiness, and strengthen compliance posture across HIPAA, FedRAMP, and NIST 800-53 programs.

You will collaborate with engineering, ISRM, Privacy, Legal, and cloud platform teams to ensure controls are implemented and audit-ready at scale. You will map auditor requests to controls, generate evidence, and build automation to streamline future

Qualifications

• 3+ years in security/privacy compliance, GRC, or compliance engineering.
• Knowledge of HIPAA, NIST 800-53, FedRAMP, and related controls.
• Translate regulatory language into scoped engineering backlog items with clear acceptance criteria.
• Experience supporting third-party audits (SOC 2, FedRAMP, HITRUST).
• Familiarity with cloud environments like AWS GovCloud or Azure Government.
• Understanding IAM/RBAC, encryption/KMS, and audit logging in compliance.
• English proficiency at B2 level or higher.

Responsibilities

• Convert HIPAA gap analyses and audit findings into Azure DevOps features with owners.
• Maintain backlog hygiene across compliance features (access control, data retention, audit logging).
• Close ownership/sprint-assignment gaps to avoid RAID risks.
• Write and execute test cases to verify controls (privileged access, deletion-on-request).
• Document pass/fail evidence for control testing activities.
• Own intake and fulfillment of auditor evidence requests and map to NIST 800-53 controls.
• Deliver evidence on auditor schedules and coordinate with cross-functional teams.
• Produce recurring compliance status reports for stakeholders.
• Develop lightweight automation to reduce manual audit effort.
• Partner with ISRM, Privacy, Legal, SRE to document inherited vs built controls.

Skills

Security compliance

GRC

Regulatory translation to backlog

English proficiency (B2+)

Education

CISA

CISSP

HCISPP

CIPP/US

Tools

Azure DevOps

Jira

SailPoint

AWS GovCloud / Azure Government

Job description

We are seeking a Lead Security Compliance Engineer to translate complex regulatory requirements into actionable engineering work, drive audit readiness, and strengthen compliance posture across HIPAA, FedRAMP, and NIST 800-53 programs. This role bridges the gap between compliance mandates and technical execution, partnering closely with engineering, ISRM, Privacy, Legal, and cloud platform teams to ensure controls are implemented, tested, and audit-ready at scale.ResponsibilitiesConvert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps Features/Stories/Tasks with clear acceptance criteria, effort estimates, and a named ownerMaintain backlog hygiene across active compliance features, including access control, data classification, log scrubbing, audit logging, data retention & deletion, and data access restrictionsClose ownership and sprint-assignment gaps before they escalate into RAID-log risksWrite and execute test cases to verify controls work as designed, such as privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-requestDocument pass/fail evidence for all control testing activitiesOwn the intake, tracking, and fulfillment of third-party auditor evidence requests, including Schellman FedRAMP Significant Change ReviewsMap each auditor request to the relevant NIST 800-53 control and coordinate with engineering, ISRM, Privacy, and Legal to gather artifactsDeliver evidence and documentation on the auditor's scheduleProduce recurring compliance status reporting for stakeholdersBuild lightweight automation, including scripts, dashboards, and evidence pipelines, to reduce manual effort in future audit cyclesPartner with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document controls inherited from AWS/Azure versus controls that must be built or owned internallyRequirements3+ years of experience in security/privacy compliance, GRC, or compliance engineering, supporting HIPAA and/or FedRAMP/NIST 800-53 programsSolid working knowledge of HIPAA Security & Privacy Rules, including administrative/physical/technical safeguards, BAAs, breach notification, and minimum necessary standardsKnowledge of NIST 800-53 control families, including AC, AU, SI, and PMDemonstrated ability to translate compliance/regulatory language into scoped, estimable engineering backlog items using Azure DevOps, Jira, or similar toolsDirect experience supporting third-party audits such as SOC 2, FedRAMP, or HITRUST, including evidence collection, control-to-evidence mapping, and meeting auditor deadlinesFamiliarity with cloud environments such as AWS GovCloud and/or Azure GovernmentUnderstanding of controls that matter for compliance, including IAM/RBAC, encryption/KMS, and audit logging, data retention & deletionEnglish proficiency at B2 level or higherNice to haveDirect experience with FedRAMP Significant Change Requests (SCR) and assessor engagementsSkills in scripting/automation using Python or Bash to automate evidence collection, control testing, or compliance dashboardsExperience with AWS IAM/identity governance tooling such as SailPoint or equivalent, and access policy management across S3, RDS, DynamoDB, RedshiftExposure to international privacy regimes such as UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, or readiness to ramp quickly as coverage expandsRelevant certifications: CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certificationExperience with security-scan remediation tracking tools such as Snyk, Wiz, Qualys, Burp, and secrets/certificate rotation programsBackground supporting legal-tech, healthcare, or government SaaS products handling regulated dataWe offerWe gather like-minded people:Top tech minds driving innovation in AI, cloud and digital platform modernizationSupportive team and agile, startup-like cultureHybrid by design mode and opportunity to work remotely within PolandChance to work abroad for up to 60 days annuallyBusiness-driven relocation opportunitiesWe provide growth opportunities:Career development programsThought leadership, mentoring, soft skills and well-being programsCertification (Anthropic, Gemini, GCP, Azure, AWS)English classesWe cover it all:Stable payParticipation in the Employee Stock Purchase Plan with a 15% discountBenefits package (health insurance, multisport, shopping vouchers)Referral bonuses up to $2,000Offices featuring entertainment and relaxation zones, table tennis and football, free snacks, coffee and moreCorporate, social and well-being eventsPlease, note:Benefits listed above are available to employees onlyWe are open for working with Contractors. Terms of B2B cooperation agreements are agreed individuallyWe will reach out to selected candidates exclusivelyEPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.