Senior Security Engineer - HIPAA, SOC 2, Cloud & AI

SAGE CARE THERAPY SERVICES; Palo Alto (CA); On-site; USD 150,000 - 210,000; Full time

Job summary

Sage Care is seeking a Security Engineer to own security and compliance across our platform, including applications, identity, and SaaS footprint. You will help shape engineering guidelines and implement critical controls, becoming the technical voice in customer security discussions.

You will report to the Head of Core Platform, Infrastructure and Security, Sage's Security Officer and HIPAA Lead, driving security across GCP, Kubernetes, and data flows while collaborating with product and

Qualifications

• 5+ years in security engineering or infrastructure with security ownership.
• Hands on SOC 2 and HIPAA experience in production environments, with Vanta, Drata, or similar.
• Application security experience: secure code review, threat modeling, and CI/CD scanning.
• Identity and access management experience with Auth0, Okta, or similar, and SSO/MFA across SaaS.
• Strong GCP or AWS security, plus Kubernetes and Terraform in production.
• Proficient in Python, and able to read and review code in TypeScript and Java; Rust a plus.

Responsibilities

• Run our compliance program: SOC 2 Type II, HIPAA safeguards, risk assessments, vendor BAAs, and pen test remediation, with Vanta as the system of record.
• Lead customer security reviews, questionnaires, and audits with hospital IT and security teams across all customers, in the U.S. and MENA.
• Set security guidelines for engineering: secure design review for new services, application security standards, dependency and code scanning, and secrets handling. Decide what must be done and work with teams to get it done.
• Own governance of identity and access: Auth0, Google Workspace, SSO and MFA, access reviews, and least privilege across cloud and SaaS.
• Build and operate infrastructure alongside the DevOps team: GCP, GKE, Terraform, and CI/CD, with IAM hardening, network controls, and policy as code built in.
• Govern PHI: access policy, audit logging, retention, and security review of new data flows, including BigQuery.
• Own detection and incident response: logging and alerting, runbooks, and the breach notification process.
• Secure our AI agents: threat model prompt injection, tool misuse, and sensitive data disclosure in voice and LLM workflows.

Skills

SOC 2

HIPAA

Application security

Identity management

GCP security

Kubernetes

Terraform

CI/CD security

Python

TypeScript

Tools

Vanta

Drata

Auth0

Okta

Google Workspace

SSO

MFA

BigQuery

HashiCorp Vault

GKE

Job description

Sage Care is seeking a Security Engineer to own security and compliance across our platform, including applications, identity, and SaaS footprint. You will help shape engineering guidelines and implement critical controls, becoming the technical voice in customer security discussions.

You will report to the Head of Core Platform, Infrastructure and Security, Sage's Security Officer and HIPAA Lead, driving security across GCP, Kubernetes, and data flows while collaborating with product and