Remote Lead Security Engineer – Trust, Privacy & Compliance

Atomic HR; Texas; Remote; USD 163,000 - 195,000; Full time

Benefits offered by this job

Fully remote in the U.S.

Employer of Record (EOR)

Technical ownership in small team

Mission-driven impact

Job summary

Atomic HR is seeking a senior security engineer to own security, privacy and compliance controls for our govtech platform. You will lead architecture, partner with the Trust Product Manager, and extend SOC 2 Type II and HIPAA controls into code.

This fully remote role across the United States requires hands-on experience designing identity and access, audit logging, threat modeling and secure delivery with IaC and CI/CD.

Qualifications

• 7+ years of software engineering, including a few years as the senior or lead engineer on production systems.
• Hands‑on SOC 2 Type II and HIPAA experience: controls you implemented and ran through an audit, and a system holding protected health information that you built or operated.
• Cloud‑native production experience, ideally on AWS, including infrastructure as code, CI/CD pipelines with approval steps, and environments you set up yourself.
• Identity and access systems you designed: authentication, role- or attribute-based authorization, service identities, secrets management, production access controls and audit logging.
• Threat modeling carried through to shipped controls, and audit, pen-test or incident findings you closed yourself.
• Good judgment on what to enforce in software and what to leave as a process, and the ability to explain that trade-off to a product lead, an auditor and an engineer.
• Comfort working autonomously while the architecture and operating model are still taking shape.
• You must be based in the U.S.

Responsibilities

• Identity & Production Access (primary focus): Design how people and services sign in, what each role is allowed to do, and where secrets are stored.
• Isolation & Audit Logging: Keep environments, tenants, workloads and sensitive data separate; build audit logs and change history for auditors.
• SOC 2 Type II & HIPAA Controls: Keep technical controls working; move access reviews and evidence pulls from manual steps into code.
• Secure Delivery: Build the release path in CI/CD and infrastructure as code, with approvals before production; publish shared modules.
• Threat Modeling & Review: Run threat models on critical workflows and turn findings into engineering requirements.
• Incident Readiness: Own logging, detection, runbooks and escalation; lead investigations and tabletop exercises.
• NIST 800-series Path: Translate requirements into controls and priorities with the PM.

Skills

Senior engineer

SOC 2 Type II

HIPAA

AWS

CI/CD

Audit logging

Threat modeling

Tools

AWS

Terraform

CI/CD

Job description

Atomic HR is seeking a senior security engineer to own security, privacy and compliance controls for our govtech platform. You will lead architecture, partner with the Trust Product Manager, and extend SOC 2 Type II and HIPAA controls into code.

This fully remote role across the United States requires hands-on experience designing identity and access, audit logging, threat modeling and secure delivery with IaC and CI/CD.