Senior Security Engineer

SAGE CARE THERAPY SERVICES; Palo Alto (CA); On-site; USD 150,000 - 210,000; Full time

Job summary

Sage Care is seeking a Security Engineer to own security and compliance across our platform, including applications, identity, and SaaS footprint. You will help shape engineering guidelines and implement critical controls, becoming the technical voice in customer security discussions.

You will report to the Head of Core Platform, Infrastructure and Security, Sage's Security Officer and HIPAA Lead, driving security across GCP, Kubernetes, and data flows while collaborating with product and

Qualifications

• 5+ years in security engineering or infrastructure with security ownership.
• Hands on SOC 2 and HIPAA experience in production environments, with Vanta, Drata, or similar.
• Application security experience: secure code review, threat modeling, and CI/CD scanning.
• Identity and access management experience with Auth0, Okta, or similar, and SSO/MFA across SaaS.
• Strong GCP or AWS security, plus Kubernetes and Terraform in production.
• Proficient in Python, and able to read and review code in TypeScript and Java; Rust a plus.

Responsibilities

• Run our compliance program: SOC 2 Type II, HIPAA safeguards, risk assessments, vendor BAAs, and pen test remediation, with Vanta as the system of record.
• Lead customer security reviews, questionnaires, and audits with hospital IT and security teams across all customers, in the U.S. and MENA.
• Set security guidelines for engineering: secure design review for new services, application security standards, dependency and code scanning, and secrets handling. Decide what must be done and work with teams to get it done.
• Own governance of identity and access: Auth0, Google Workspace, SSO and MFA, access reviews, and least privilege across cloud and SaaS.
• Build and operate infrastructure alongside the DevOps team: GCP, GKE, Terraform, and CI/CD, with IAM hardening, network controls, and policy as code built in.
• Govern PHI: access policy, audit logging, retention, and security review of new data flows, including BigQuery.
• Own detection and incident response: logging and alerting, runbooks, and the breach notification process.
• Secure our AI agents: threat model prompt injection, tool misuse, and sensitive data disclosure in voice and LLM workflows.

Skills

SOC 2

HIPAA

Application security

Identity management

GCP security

Kubernetes

Terraform

CI/CD security

Python

TypeScript

Tools

Vanta

Drata

Auth0

Okta

Google Workspace

SSO

MFA

BigQuery

HashiCorp Vault

GKE

Job description

About Sage Care

Sage Care is a fast growing, early stage healthcare startup transforming care navigation with AI. Our platform helps patients find the right care, enables providers to focus on the people who need them most, and improves access, quality, and economic outcomes at scale.

Founded by leaders from Apple, Uber, and Carbon Health, Sage Care is backed by top tier investors including General Catalyst and Chelsea Clinton. We work with health systems across the U.S. and have expanded internationally to the MENA region.

About the Role

Hospitals trust Sage with patient data, and every new health system brings security reviews and audits. As our first dedicated Security Engineer, you'll own security and compliance across our platform, applications, identity, and SaaS footprint, and you'll share ownership of the GCP and Kubernetes infrastructure that runs it. You'll set the guidelines engineering and product teams follow, implement the controls that matter most yourself, and be the technical voice in front of customer security teams.

You'll report to the Head of Core Platform, Infrastructure and Security, who serves as Sage's Security Officer and HIPAA Lead.

What You’ll Do

• Run our compliance program: SOC 2 Type II, HIPAA safeguards, risk assessments, vendor BAAs, and pen test remediation, with Vanta as the system of record. Extend it to HITRUST and international requirements as we grow.

• Lead customer security reviews, questionnaires, and audits with hospital IT and security teams across all customers, in the U.S. and MENA.

• Set security guidelines for engineering: secure design review for new services, application security standards, dependency and code scanning, and secrets handling. Decide what must be done and work with teams to get it done.

• Own governance of identity and access: Auth0, Google Workspace, SSO and MFA, access reviews, and least privilege across cloud and SaaS.

• Build and operate infrastructure alongside the DevOps team: GCP, GKE, Terraform, and CI/CD, with IAM hardening, network controls, and policy as code built in.

• Govern PHI: access policy, audit logging, retention, and security review of new data flows, including BigQuery.

• Own detection and incident response: logging and alerting, runbooks, and the breach notification process.

• Secure our AI agents: threat model prompt injection, tool misuse, and sensitive data disclosure in voice and LLM workflows.

What We’re Looking For

Required

• 5+ years in security engineering or infrastructure with security ownership.

• Hands on SOC 2 and HIPAA experience in production environments, with Vanta, Drata, or similar.

• Application security experience: secure code review, threat modeling, and CI/CD scanning.

• Identity and access management experience with Auth0, Okta, or similar, and SSO/MFA across SaaS.

• Strong GCP or AWS security, plus Kubernetes and Terraform in production.

• Proficient in Python, and able to read and review code in TypeScript and Java; Rust a plus.

• Clear communication with engineers, auditors, and customer security teams; comfortable leading customer facing reviews.

• Stand up auditable, policy based access control and dynamic secrets management (HashiCorp Vault or equivalent) for services, infrastructure, and engineers.

Nice to Have

• Healthcare experience handling PHI.

• HITRUST, ISO 27001, or UAE or other international healthcare compliance.

• Securing LLM or voice AI products.

• Experience as an early or first security hire at a startup.

How We Work

At Sage Care, our values shape how we build, collaborate, and serve.

• Do Good Through Serving People: We serve users, teammates, and communities with integrity, compassion, kindness, and optimism.

• Innovate with Safety, Evidence, and Transparency: We move quickly while prioritizing trust, safety, ethical decision making, and evidence based approaches.

• Lead with Curiosity and Kindness: We ask questions before making assumptions and approach discovery, debate, and problem solving with humility and care.

• We, Not Me: We believe the best work happens through collaboration, mutual respect, and constructive feedback.

• Efficiency and AI in All We Do: ... etc