Lead Security Engineer (m/w/d)

Recare Deutschland GmbH; United States; Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Remote-friendly company

Flexible working hours

Edenred card

Extra vacation day

Job summary

Recare Deutschland GmbH is seeking a founding security engineer to join as Deputy CISO. You will build the security engineering function from the ground up, blending hands-on engineering with end-to-end program ownership in compliance, incident response, and customer-facing security for AI features in a regulated clinical setting.

You will influence security across the platform, define incident response, runbooks, and an on-call model in a company without a dedicated SOC, while engaging with

Qualifications

• Six or more years of combined software and security engineering experience with ownership of a security program.
• Direct experience as the technical counterpart through at least one ISO 27001, C5, or SOC 2 certification cycle, including control design and working with auditors.
• Practical vulnerability management experience in production, covering scanners and remediation follow-through.
• Active engagement with the security community and informed opinions on current incidents.
• Genuine curiosity about AI security, defending AI systems and using AI tooling.
• Ability to communicate directly in English with engineers, auditors, and healthcare security teams.

Responsibilities

• Drive vulnerability management across code repositories, including scanner deployment and triage workflow.
• Act as security counterpart to the platform team, reviewing infrastructure decisions like customer‑managed keys or HSMs.
• Lead compliance work: control design and assessments for ISO 27001, C5, or SOC 2; scope pentests and prepare security case for MDR.
• Build customer-facing security narratives and evidence packages; participate in live conversations with hospital security teams.
• Define incident response runbooks and on-call rotations for a company without a formal SOC.
• Monitor threat landscape and translate supply-chain and AI risks into concrete actions for endpoints and accounts.

Skills

Security engineering

Vulnerability management

Incident response

Compliance

AI security

Security program ownership

English communication

Education

ISO 27001 certification cycle

SOC 2 certification cycle

C5 certification cycle

Tools

Vulnerability scanners

Dependency tooling

Job description

Role overview

This is a founding security engineer role inside a healthcare technology organization, joining as Deputy CISO to build the security engineering function from the ground up as a senior individual contributor. The position blends hands‑on engineering with end‑to‑end program ownership across compliance, incident response, customer‑facing security work, and the emerging threat surface created by AI features in a regulated clinical setting. It suits someone who wants broad influence and visible impact without an immediate management layer.

Responsibilities

• Drive vulnerability management across code repositories, including scanner deployment, dependency update automation, and the triage workflow that actually closes findings.
• Act as a security counterpart to the platform team, reviewing sensitive infrastructure decisions and evaluating options such as customer‑managed keys or hardware security modules.
• Lead the technical side of compliance work: control design and assessments for existing ISO 27001 and C5 Type II attestations, pentest scoping and follow‑up, and preparing the security case for a potential upcoming Class IIa medical device under MDR, with regulations like the EU Cyber Resilience Act on the horizon.
• Build the customer‑facing security narrative, including reusable documentation, evidence packages, and AI‑assisted questionnaire handling, occasionally joining live conversations with hospital security teams.
• Define incident response process, runbooks, and an on‑call rotation that fits a company without a dedicated SOC, and lead response when something is real.
• Monitor the broader threat landscape, turn emerging supply‑chain and AI risks into concrete actions, and set baselines that IT applies to endpoints and accounts.

Requirements

• Six or more years of combined software and security engineering experience, with a track record of owning a security program or a significant portion of one.
• Direct experience as the technical counterpart through at least one ISO 27001, C5, or SOC 2 certification cycle, including control design, working with auditors, and contributing to the Statement of Applicability.
• Practical vulnerability management experience in production, covering scanners, dependency tooling, triage, and remediation follow‑through.
• Active engagement with the security community, forming informed opinions on current incidents before they hit the news cycle.
• Genuine curiosity about AI security, covering both defending AI systems (agents, sandboxing, data flows) and using AI tooling to work at leverage.
• Ability to communicate directly in English with engineers, auditors, and healthcare customer security teams without translation support.

Nice to have

• German language skills, useful for German‑speaking customers and C5 assessors.
• Experience in healthcare or another regulated industry.
• Offensive security background.
• Certifications such as OSCP or CISSP.

Benefits and work setup

• Remote‑friendly company with flexible working hours and the option to arrange workations.
• Edenred card usable for personal needs.
• An additional vacation day so the birthday can be spent with family.
• Flat‑hierarchy culture built on mutual respect, recognition, and team accountability.