Lead Security Compliance Engineer - HIPAA, FedRAMP, NIST

EPAM Systems Inc

United States

Remote

USD 120,000 - 210,000

Full time

42 hours ago

Be an early applicant

Application generator

A complete application in a minute — tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

EPAM Systems Inc. seeks a Lead Security Compliance Engineer to translate regulatory requirements into actionable engineering work, drive audit readiness, and strengthen the compliance posture across HIPAA, FedRAMP, and NIST 800-53 programs.

You will coordinate with engineering, ISRM, Privacy, Legal and cloud teams to ensure controls are implemented, tested, and audit-ready at scale. Responsibilities include turning audit findings into backlog items, maintaining backlog hygiene, writing tests,

Qualifications

3+ years of experience in security/privacy compliance, GRC, or compliance engineering.
Strong knowledge of HIPAA Security & Privacy Rules and safeguards.
Knowledge of NIST 800-53 control families (AC, AU, SI, PM).
Ability to translate regulatory language into backlog items using Azure DevOps or Jira.
Experience supporting third-party audits (SOC 2, FedRAMP, HITRUST).
Familiarity with cloud environments such as AWS GovCloud or Azure Government.
Understanding IAM/RBAC, encryption/KMS, and audit logging.
English proficiency at B2 level or higher.
Nice to have: FedRAMP SCRs and assessor engagements.
Experience with scripting (Python or Bash) to automate evidence collection.

Responsibilities

Convert HIPAA gap analyses and audit findings into scoped Azure DevOps features.
Maintain backlog hygiene across compliance features (access control, data classification, logging, retention).
Close ownership and sprint-assignment gaps to avoid RAID-log risks.
Write and execute test cases to verify controls work as designed.
Document pass/fail evidence for control testing.
Manage intake and fulfillment of auditor evidence requests (Schellman FedRAMP reviews).
Map auditor requests to relevant NIST 800-53 controls and coordinate with teams.
Deliver evidence and documentation on the auditor's schedule.
Produce recurring compliance status reporting for stakeholders.
Build lightweight automation, dashboards, and pipelines for future audits.
Collaborate with ISRM, Privacy, Legal, SRE, and cloud teams on inherited vs built controls.