Lead Security Engineer (US-Remote)

Braintrust; United States; On-site; USD 185,000 - 215,000; Full time

Benefits offered by this job

Employee Stock Options

Health benefits and 401K matching

Flexible paid vacation, parental and {

Job summary

Handl Health is seeking its first full-time Lead Security Engineer to own security and compliance, including SOC 2, HIPAA, and vendor risk management. This hands-on role emphasizes building tooling, automating evidence collection, and maturing the program as we scale.

You'll split time between compliance/GRC work and technical security engineering, reviewing IAM, PHI-bearing services, and securing our AWS infrastructure while enabling rapid product development.

Qualifications

• 6+ years in software or infrastructure engineering, with 2+ years focused on security.
• Hands-on experience owning SOC 2 audits end-to-end, ideally Type II.
• Hands-on knowledge of AWS security (IAM, S3, CloudTrail, GuardDuty).
• Ability to build tooling and automation; able to code against APIs.
• Practical AI tool usage in security workflows; awareness of AI/LLM risks.
• Track record building security programs at startups/growth-stage companies.
• Strong written communication for auditors and customers.

Responsibilities

• Own end-to-end security and compliance posture, including HIPAA, SOC 2, and vendor risk management.
• Build a living AI-enabled compliance knowledge base with current evidence mappings.
• Own the BAA lifecycle with customers and vendors.
• Conduct regular security assessments of AWS infrastructure and define remediation roadmap.
• Threat model PHI-bearing services and review IAM, networks, S3 access, encryption, and logging.
• Establish and maintain security policies, incident response procedures, and access control frameworks.
• Own security tooling and automation, including detection and evidence-collection pipelines.
• Evaluate and manage risk across evolving AI toolchain and third-party connectors.
• Lead security reviews for new product features and AI capabilities before shipping.
• Interface with customers on security questionnaires, audits, and compliance requirements.
• Build security culture with training and lightweight processes engineers follow.

Skills

Security engineering

Compliance program

SOC 2 audits

AWS security

Tools

Terraform

Pulumi

AWS IAM

CloudTrail

Job description

About This Role

Handl Health is a post-Series A healthcare technology company building AI-powered care navigation and cost estimation products.

We're hiring our first full-time Lead Security Engineer to take full ownership of our security and compliance program. We're SOC 2 certified and HIPAA compliant, with security and compliance currently shared across engineering and ops. As we scale, these functions need a dedicated owner who can mature the program, deepen our operational practices, and let us keep moving fast without accumulating risk.

This is an engineering-first, hands-on role, not a managerial or advisory one. It splits roughly evenly between compliance and GRC on one side and technical security engineering on the other.

You'll own outcomes, not just recommendations, and you'll spend real time in the weeds: reviewing IAM policies, threat modeling PHI-bearing services, and building the tooling and knowledge base that keep the program running without constant manual effort.

What You'll Do

• Own the end-to-end security and compliance posture, including HIPAA, SOC 2, and vendor risk management, as the accountable party for audit cycles from scoping through evidence and auditor management.
• Build and maintain a living, AI-enabled compliance knowledge base so evidence and control mappings are queryable and current, not reconstructed under audit pressure.
• Own the BAA lifecycle with customers and vendors.
• Conduct regular security assessments of our infrastructure (AWS, S3 data lake, AI integrations) and build a prioritized remediation roadmap.
• Threat model our PHI-bearing services and drive remediation, with hands-on review of IAM, network boundaries, S3 access patterns, encryption, and logging.
• Establish and maintain security policies, incident response procedures, and access control frameworks.
• Own security tooling and automation, including detection, alerting, and evidence-collection pipelines you build yourself, leveraging AI to streamline manual processes where appropriate.
• Evaluate and manage risk across our evolving AI toolchain, including enterprise LLM platforms, MCP integrations, and third-party connectors (Slack, Gmail, Google Drive).
• Own DLP strategy for our data lake, including PHI quarantine architecture and access controls.
• Manage our JAMF instance and endpoint security across the organization.
• Partner with engineering on secure SDLC: branch protection, risk gating, dependency and secrets management.
• Lead security reviews for new product features and AI capabilities before they ship.
• Interface with customers and partners on security questionnaires, audits, and compliance requirements.
• Build the security culture: training, awareness, and lightweight processes that engineers actually follow.

What You Bring

• 6+ years in software or infrastructure engineering, with 2+ years focused on security and experience owning a security or compliance program end-to-end.
• Deep SOC 2 experience: You've personally owned and managed SOC 2 audits end-to-end, ideally Type II, as the accountable owner rather than a contributor.
• Hands-on knowledge of AWS security (IAM Identity Center, S3 policies, CloudTrail, GuardDuty). You can read a policy document and a Terraform/Pulumi diff and know what's wrong with both.
• Ability to build tooling and automation yourself. You're comfortable writing code and scripting against APIs to eliminate manual compliance toil.
• Practical, hands-on experience using AI tools in engineering or security workflows. You're actively experimenting with and applying AI to improve how work gets done, and can think critically about AI/LLM security risks, including prompt injection, data exfiltration, model safety, and supply-chain risks.
• Track record of building security programs at startups or growth-stage companies, not just maintaining them at large enterprises.
• Strong written communication. Much of this role is producing clear, defensible documentation for auditors and customers.

Nice to Have

• Experience with HIPAA compliance and securing systems that handle PHI.
• Experience with PHI de-identification and handling in ML/AI pipelines.
• Familiarity with healthcare payer or TPA ecosystems.
• Background in securing API products and B2B data integrations.

Compensation

The base salary range for this position is $185,000-$215,000, depending on your location, experience, and market conditions

Benefits You'll Receive

• Employee Stock Options
• Generous health benefits and 401K matching
• Flexible paid vacation, parental and medical leave
• A stipend to help you set up a home office

Why Handl Health

• High-impact role where your work directly protects patients' data and supports the company as it scales.
• Own an established security and compliance program with the mandate to mature and deepen it, with direct ownership and executive visibility.
• Work alongside a technical leadership team that takes security seriously.
• Post-Series A company with the resources to invest in security properly.

Handl Health is an equal opportunity employer. We evaluate candidates on demonstrated ability and do not discriminate on any protected basis.