Senior Security Engineer - Cloud, HIPAA & AI Security Lead

Sage Care; Palo Alto (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Sage Care is seeking its first dedicated Security Engineer to own security and compliance across its platform, apps, identity, and SaaS footprint. You will share ownership of GCP and Kubernetes infrastructure and set the guidelines engineering and product teams follow.

You will lead security reviews with hospitals, manage IAM, run security audits, and help secure AI agents and data flows; report to the Head of Core Platform, Infrastructure and Security.

Qualifications

• 5+ years in security engineering or infrastructure with security ownership.
• Hands on SOC 2 and HIPAA experience in production environments, with Vanta, Drata, or similar.
• Application security experience: secure code review, threat modeling, and CI/CD scanning.
• Identity and access management experience with Auth0, Okta, or similar, and SSO/MFA across SaaS.

Responsibilities

• Run our compliance program: SOC 2 Type II, HIPAA safeguards, risk assessments, vendor BAAs, and pen test remediation, with Vanta as the system of record.
• Lead customer security reviews, questionnaires, and audits with hospital IT and security teams across all customers, in the U.S. and MENA.
• Set security guidelines for engineering: secure design review for new services, application security standards, dependency and code scanning, and secrets handling.
• Own governance of identity and access: Auth0, Google Workspace, SSO and MFA, access reviews, and least privilege across cloud and SaaS.
• Build and operate infrastructure alongside the DevOps team: GCP, GKE, Terraform, and CI/CD, with IAM hardening, network controls, and policy as code built in.
• Govern PHI: access policy, audit logging, retention, and security review of new data flows, including BigQuery.
• Own detection and incident response: logging and alerting, runbooks, and the breach notification process.
• Secure our AI agents: threat model prompt injection, tool misuse, and sensitive data disclosure in voice and LLM workflows.

Skills

SOC 2

HIPAA compliance

Application security

IAM

Auth0

Okta

GCP

Kubernetes

Terraform

Python

TypeScript

Java

Communication

Tools

Vanta

Drata

GKE

HashiCorp Vault

CI/CD tooling

BigQuery

Job description

Sage Care is seeking its first dedicated Security Engineer to own security and compliance across its platform, apps, identity, and SaaS footprint. You will share ownership of GCP and Kubernetes infrastructure and set the guidelines engineering and product teams follow.

You will lead security reviews with hospitals, manage IAM, run security audits, and help secure AI agents and data flows; report to the Head of Core Platform, Infrastructure and Security.