Senior Engineer / Tech Lead, Trust (Security, Privacy & Compliance) | GovTech

Atomic - Remote Jobs; Alexandria (VA); On-site; USD 150,000 - 210,000; Full time

Job summary

Atomic - Remote Jobs client seeks a senior security engineer to own platform security, privacy, and compliance controls, partnering with the Trust Product Manager. You’ll lead architecture and runbooks, not just audit.

Starting with SOC 2 Type II and HIPAA controls, you’ll move manual evidence collection into code, drive NIST 800-series alignment, and shape the secure delivery pipeline with IaC and CI/CD.

Qualifications

• 7+ years of software engineering experience.
• Has been senior or lead engineer on production systems.
• Hands-on contributor to application and infrastructure code in the last year or two.

Responsibilities

• Design identity and production access controls.
• Implement audit logging and isolation between environments.
• Maintain SOC 2 Type II and HIPAA controls and address audit findings.
• Build secure delivery via CI/CD and infrastructure as code.
• Lead threat modeling and translate findings into engineering requirements.
• Own incident readiness including runbooks and detections.
• Translate NIST requirements into controls and priorities.

Skills

Security engineering

Access management

Threat modeling

Audit logging

CI/CD

Infrastructure as code

Incident response

Regulatory compliance

Tools

Terraform

CI/CD pipelines

Job description

Company Overview:

Our client is a venture-backed govtech startup that helps families find the benefit programs they qualify for, apply to several at once and stay enrolled as rules change. State agencies, Medicaid managed care organizations and employers pay for the platform. It now runs eligibility checks and applications across federal, state and local programs. Its customers are highly regulated, so security and privacy shape how the team builds. The team is small and fully remote across the U.S.

Your Role:

• This is not a "review and advise" security role. You build the controls yourself.

• State and federal buyers are asking for stricter security standards. Security and privacy are now core parts of the platform, not side projects.

• You'll be the senior engineer and tech lead for the platform's security, privacy and compliance controls, and the technical partner to the Trust Product Manager. The PM owns requirements, governance and the roadmap. You own the architecture and the working systems.

• You'll start with the engineering behind the existing SOC 2 Type II and HIPAA controls. Recurring manual work like access reviews and evidence collection moves into code.

• Then you'll lead the technical side of the company's NIST 800-series alignment..

What you'll do

• Identity & Production Access (primary focus)

  • Design how people and services sign in, what each role is allowed to do, and where secrets are stored.

  • Decide how engineers get into production and who approves that access.

  • Write the design and the code, and agree on the requirements with the Trust PM.

• Isolation & Audit Logging

  • Keep environments, tenants, workloads and sensitive data separate from each other.

  • Build audit logs and change history that show who did what, in a form outside auditors can test.

• SOC 2 Type II & HIPAA Controls

  • Keep the technical controls working, and move access reviews and evidence pulls from manual steps into code.

  • Take every technical audit finding through to closure, and work with auditors on their tests.

• Secure Delivery

  • Build the release path in CI/CD and infrastructure as code, with approvals before anything reaches production.

  • Publish shared modules and reference implementations so other teams get the controls by default.

• Threat Modeling & Review

  • Run threat models on critical workflows and turn each finding into an engineering requirement.

  • Review security-sensitive code, infrastructure and architecture changes before they go live.

• Incident Readiness

  • Own logging, detection, runbooks and escalation paths on the engineering side.

  • Lead or support investigation and containment when an incident happens, and join tabletop exercises with the PM and leadership.

• NIST 800-series Path

  • With the PM, translate NIST requirements into controls and priorities.

  • Give leadership a technical roadmap for state and federal environments, moving toward FedRAMP-aligned practices where they apply.

You Bring:

• 7+ years of software engineering, including a few years as the senior or lead engineer on production systems. You've committed application and infrastructure code yourself in the last year or two.