Security Engineer (HIPAA / SOC 2)

Medonix; United States; Remote; USD 170,000 - 230,000; Full time

Job summary

Medonix is seeking its first dedicated security engineer to lead application and platform security within a HIPAA-regulated, SOC 2 Type II / HITRUST CSF environment. You will partner with engineering and compliance to make security an engineering output rather than a checkbox.

The role focuses on owning SOC 2 and HITRUST controls, managing bug bounty, building in-house tooling, and leading incident response.

Qualifications

• 5+ years in application or platform security at a regulated SaaS or healthcare company.
• Hands-on offensive security capable of reading a codebase to find what an auditor would miss.
• Familiarity with HIPAA, SOC 2 Type II, and at least one of HITRUST CSF / NIST 800-66 / ISO 27001.
• Comfort writing code in TypeScript, Go, or Python, not just configuring tools.

Responsibilities

• Own the SOC 2 and HITRUST control evidence in partnership with the compliance team.
• Run and improve the bug-bounty / responsible-disclosure program.
• Build the in-house security tooling that makes the controls cheap to maintain.
• Lead incident response when a real one hits.
• Design reviews and threat modeling in design sprints; auditor-evidence work and security questionnaire reviews.

Skills

Offensive security

Threat modeling

Code reading

Security tooling

Tools

TypeScript

Go

Python

Job description

Lead application and platform security for a HIPAA-regulated, SOC 2 Type II / HITRUST CSF environment. Hands-on, measured, and resourced.

You will be the first dedicated security engineer on the platform team, partnering with engineering and compliance to make security an engineering output rather than a checklist exercise. The current posture: HIPAA + SOC 2 Type II + HITRUST CSF + PCI DSS Level 1, with annual third-party penetration testing and a public bug-bounty program in flight.

What you will own

• Own the SOC 2 and HITRUST control evidence in partnership with the compliance team.
• Run and improve the bug-bounty / responsible-disclosure program.
• Build the in-house security tooling that makes the controls cheap to maintain.
• Lead incident response when a real one hits.

Must-haves

• 5+ years in application or platform security at a regulated SaaS or healthcare company.
• Hands-on offensive security skills: you can read a codebase and find what an auditor would miss.
• Familiarity with HIPAA, SOC 2 Type II, and at least one of HITRUST CSF / NIST 800-66 / ISO 27001.
• Comfort writing code in TypeScript, Go, or Python, not just configuring tools.

Nice-to-haves

• CISSP, OSCP, or equivalent practical credential.
• Public security research, conference talks, or bug-bounty track record.
• Experience leading a SOC 2 Type II audit through to clean opinion.

Day in the life

Mornings are typically design reviews and threat modeling on whatever is shipping next. Afternoons split between auditor-evidence work, security-tooling improvements, and customer-facing security questionnaire reviews (which we want fewer of, not more). When something real happens, you lead, but most weeks are proactive, not reactive.