Lead Security Engineer — SOC 2, HIPAA, AI Security

Braintrust; United States; On-site; USD 185,000 - 215,000; Full time

Benefits offered by this job

Employee Stock Options

Health benefits and 401K matching

Flexible paid vacation, parental and {

Job summary

Handl Health is seeking its first full-time Lead Security Engineer to own security and compliance, including SOC 2, HIPAA, and vendor risk management. This hands-on role emphasizes building tooling, automating evidence collection, and maturing the program as we scale.

You'll split time between compliance/GRC work and technical security engineering, reviewing IAM, PHI-bearing services, and securing our AWS infrastructure while enabling rapid product development.

Qualifications

• 6+ years in software or infrastructure engineering, with 2+ years focused on security.
• Hands-on experience owning SOC 2 audits end-to-end, ideally Type II.
• Hands-on knowledge of AWS security (IAM, S3, CloudTrail, GuardDuty).
• Ability to build tooling and automation; able to code against APIs.
• Practical AI tool usage in security workflows; awareness of AI/LLM risks.
• Track record building security programs at startups/growth-stage companies.
• Strong written communication for auditors and customers.

Responsibilities

• Own end-to-end security and compliance posture, including HIPAA, SOC 2, and vendor risk management.
• Build a living AI-enabled compliance knowledge base with current evidence mappings.
• Own the BAA lifecycle with customers and vendors.
• Conduct regular security assessments of AWS infrastructure and define remediation roadmap.
• Threat model PHI-bearing services and review IAM, networks, S3 access, encryption, and logging.
• Establish and maintain security policies, incident response procedures, and access control frameworks.
• Own security tooling and automation, including detection and evidence-collection pipelines.
• Evaluate and manage risk across evolving AI toolchain and third-party connectors.
• Lead security reviews for new product features and AI capabilities before shipping.
• Interface with customers on security questionnaires, audits, and compliance requirements.
• Build security culture with training and lightweight processes engineers follow.

Skills

Security engineering

Compliance program

SOC 2 audits

AWS security

Tools

Terraform

Pulumi

AWS IAM

CloudTrail

Job description

Handl Health is seeking its first full-time Lead Security Engineer to own security and compliance, including SOC 2, HIPAA, and vendor risk management. This hands-on role emphasizes building tooling, automating evidence collection, and maturing the program as we scale.

You'll split time between compliance/GRC work and technical security engineering, reviewing IAM, PHI-bearing services, and securing our AWS infrastructure while enabling rapid product development.