Sr. Security & Compliance Engineer

Residex, LLC; United States; On-site; USD 130,000 - 200,000; Full time

Job summary

Residex, LLC is seeking a Senior Security & Compliance Engineer to lead security standards across its AI-powered platform and SaaS stack. You will mentor engineers and drive security initiatives spanning data protection, identity, and incident response.

You will own audits (SOC 2 II, HIPAA), manage third-party risk, and shape least-privilege access across the environment, partnering with executives and product teams.

Qualifications

• Hands-on cloud security experience at scale (AWS/Azure/GCP).
• Direct ownership of SOC 2 Type II or HIPAA audits.
• Experience with IAM, SSO, MFA, and privileged access.
• Threat modeling, secure coding, and CI/CD security.
• Strong communication to executives and stakeholders.

Responsibilities

• Define, review, and approve security standards and strategy across Residex’s cloud infra and apps.
• Lead security event monitoring with SIEM/EDR; manage alert triage and remediation.
• Direct vulnerability assessments and pentests; triage findings by risk.
• Own SOC 2 Type II and HIPAA audits; coordinate evidence with auditors.
• Manage vendor risk reviews and security terms with partners.
• Define least-privilege IAM standards; review SSO/MFA and RBAC implementations.
• Mature corporate security posture across SaaS systems including Entra ID and M365.
• Mentor engineers on secure coding, threat modeling, and reviews.
• Lead incident response planning, root-cause analysis, and post-incident reporting.
• Evaluate security tooling; advise build-vs-buy decisions.
• Develop security awareness training and documentation for teams.

Skills

Security leadership

Threat modeling

Secure coding

Executive communication

Incident response

Automation scripting

Education

CISSP

CISM

HCISPP

CCSP

GCIH

GCFA

GCFE

CEH

CySA+

Tools

Splunk

CrowdStrike

Elastic

Microsoft Entra ID

Auth0

Job description

All Jobs > Sr. Security & Compliance Engineer

The Senior Security & Compliance Engineer will serve as a technical leader in protecting Residex’s AI-powered platform, its corporate and SaaS environment, and the sensitive resident, caregiver, and operator data it manages across our growing footprint of senior living communities, setting security standards and mentoring engineers across the organization.

Responsibilities include:

• Define, review, and approve security standards and security strategy across Residex’s cloud infrastructure, applications, and 14+ integrated modules, including EHR, eMAR, and Workforce, partnering with Architecture and Engineering leadership on the designs that implement them.
• Lead security event monitoring using SIEM and EDR tooling; oversee alert triage, drive complex forensic investigations, and direct remediation efforts across engineering teams, acting as the senior escalation point for high-severity incidents.
• Direct vulnerability assessment and penetration testing programs across the platform, prioritizing findings by risk and holding engineering leadership accountable for remediation timelines.
• Own Residex’s certification program end to end, including SOC 2 Type II, HIPAA, and applicable state regulatory requirements — control design, control operation, evidence collection, and serving as the primary technical point of contact for auditors and assessors, in partnership with executive leadership. Own the ongoing response to customer security questionnaires and vendor risk assessments as standing work, maintaining a reusable library of approved control positions and supporting evidence.
• Own third-party and vendor risk management, including security review of new vendors and integrations, ongoing monitoring of critical suppliers, and the security and privacy terms Residex requires of its partners.
• Define least-privilege standards for identity and access management (IAM), including SSO, MFA, and role-based access controls, and review and approve their implementation to safeguard resident and operator data at scale.
• Mature Residex’s corporate security posture across all SaaS systems and business operations — including Microsoft Entra ID and M365, endpoint management, SaaS application governance, email security, data loss prevention, and identification and remediation of unsanctioned application use.
• Mentor engineering teams on secure coding practices, threat modeling, and security review, embedding a security-first culture across the software development lifecycle.
• Serve as the security voice in product design reviews and internal system infrastructure decisions, partnering with Product, Architecture, and Engineering to set and approve security requirements without owning delivery of those systems.
• Lead incident response planning and execution, including root-cause analysis, executive-level post-incident reporting, and continuous improvement of response playbooks.
• Drive evaluation and deployment of security tooling, such as endpoint protection, network monitoring, and secrets management, and make build-vs-buy recommendations to executive leadership to strengthen the platform’s overall security posture.
• Design and lead security awareness training and documentation programs for internal teams handling sensitive resident data, and mentor junior security engineers.

Requirements

• 8+ years of experience in a cybersecurity engineering, security operations, or related technical security role, including experience leading investigations or mentoring other engineers, ideally at a B2B SaaS company.
• Deep, hands-on expertise with cloud security in AWS (preferred), Azure, or GCP, including IAM, network security groups, and logging/monitoring services, with a track record of designing security architecture at scale.
• Practical experience administering enterprise identity platforms — Microsoft Entra ID and Auth0 or equivalent — including SSO, MFA, conditional access, and privileged access management.
• Advanced experience with SIEM/EDR platforms (e.g., Splunk, CrowdStrike, Elastic) and vulnerability management tools, including tool selection and program ownership.
• Direct ownership of at least one full SOC 2 Type II or HIPAA audit cycle as the primary technical point of contact for auditors, including control design, evidence collection, and remediation of findings; working knowledge of ISO 27001 a plus.
• Hands-on experience conducting HIPAA Security Rule risk analyses and managing Business Associate Agreements and the security obligations they carry.
• Demonstrated ownership of secure software development practices, including threat modeling, code review, and CI/CD pipeline security, with experience setting standards adopted organization wide.
• Strong scripting or automation experience (Python, Bash, or similar) to streamline and scale security operations.
• Excellent communication and executive presence, with the ability to present security risk, incident findings, and remediation plans to senior leadership, the board, and both technical and non-technical stakeholders.
• Advanced security certifications strongly preferred — CISSP or CISM, with HCISPP and CCSP valued for healthcare and cloud depth; GCIH, GCFA, GCFE, CEH, or CySA+ are a plus.
• Experience in healthcare, senior living, or another highly regulated industry strongly preferred; genuine interest in protecting sensitive resident and caregiver data is valued, along with prior experience mentoring or informally leading other security engineers.