Sr. Security & Compliance Engineer

Residex®; United States; On-site; USD 150,000 - 180,000; Full time

Job summary

Residex is seeking a Senior Security & Compliance Engineer to lead security standards across our AI-powered platform, cloud infrastructure, and healthcare-related data across senior living communities. You will mentor engineers, define least-privilege IAM, and own the SOC 2 Type II and HIPAA programs.

In this role, you will drive incident response, vulnerability management, and vendor risk while partnering with executives to strengthen Residex’s security posture across SaaS, data, and product

Qualifications

• Experience leading investigations or mentoring engineers at a B2B SaaS company.
• Hands-on cloud security design at scale in AWS, Azure, or GCP.
• Experience with enterprise identity platforms including SSO and MFA.
• Direct ownership of full SOC 2 Type II or HIPAA audit cycles.
• HIPAA Security Rule risk analyses and BAA management.
• Secure software development practices with threat modeling and CI/CD.
• Strong scripting/automation to streamline security ops.
• Excellent communication with senior leadership and stakeholders.
• Advanced security certifications (CISSP/CISM) preferred.

Responsibilities

• Define, review, and approve security standards across Residex’s cloud and apps.
• Lead security monitoring, incident triage, and remediation escalation.
• Direct vulnerability testing programs and remediation accountability.
• Own SOC 2 Type II and HIPAA audits and evidence collection with auditors.
• Manage third-party/vendor risk and security reviews with vendors.
• Define least-privilege IAM standards and implement controls.
• Mature corporate security posture across SaaS systems and identity.
• Mentor engineers on secure coding, threat modeling, and reviews.
• Lead security in product design reviews and infrastructure decisions.
• Drive incident response planning, root-cause analysis, and playbooks.
• Evaluate security tooling and provide build-vs-buy recommendations.
• Design security awareness training and documentation for teams.

Skills

Security architecture

Leadership

Cloud security

IAM

SIEM/EDR

Vulnerability management

Threat modeling

Secure SDLC

Python/Bash scripting

Communication

Education

CISSP or CISM

Healthcare/regulatory security background

SOC 2/HIPAA audit experience

Tools

SIEM (Splunk/CrowdStrike/Elastic)

EDR tooling

Microsoft Entra ID

Auth0 or equivalent

ISO 27001 knowledge

Job description

Description

The Senior Security & Compliance Engineer will serve as a technical leader in protecting Residex’s AI-powered platform, its corporate and SaaS environment, and the sensitive resident, caregiver, and operator data it manages across our growing footprint of senior living communities, setting security standards and mentoring engineers across the organization.

Job Type

Full-time

Responsibilities

• Define, review, and approve security standards and security strategy across Residex’s cloud infrastructure, applications, and 14+ integrated modules, including EHR, eMAR, and Workforce, partnering with Architecture and Engineering leadership on the designs that implement them.
• Lead security event monitoring using SIEM and EDR tooling; oversee alert triage, drive complex forensic investigations, and direct remediation efforts across engineering teams, acting as the senior escalation point for high-severity incidents.
• Direct vulnerability assessment and penetration testing programs across the platform, prioritizing findings by risk and holding engineering leadership accountable for remediation timelines.
• Own Residex’s certification program end to end, including SOC 2 Type II, HIPAA, and applicable state regulatory requirements - control design, control operation, evidence collection, and serving as the primary technical point of contact for auditors and assessors, in partnership with executive leadership. Own the ongoing response to customer security questionnaires and vendor risk assessments as standing work, maintaining a reusable library of approved control positions and supporting evidence.
• Own third-party and vendor risk management, including security review of new vendors and integrations, ongoing monitoring of critical suppliers, and the security and privacy terms Residex requires of its partners.
• Define least-privilege standards for identity and access management (IAM), including SSO, MFA, and role-based access controls, and review and approve their implementation to safeguard resident and operator data at scale.
• Mature Residex’s corporate security posture across all SaaS systems and business operations - including Microsoft Entra ID and M365, endpoint management, SaaS application governance, email security, data loss prevention, and identification and remediation of unsanctioned application use.
• Mentor engineering teams on secure coding practices, threat modeling, and security review, embedding a security-first culture across the software development lifecycle.
• Serve as the security voice in product design reviews and internal system infrastructure decisions, partnering with Product, Architecture, and Engineering to set and approve security requirements without owning delivery of those systems.
• Lead incident response planning and execution, including root-cause analysis, executive-level post-incident reporting, and continuous improvement of response playbooks.
• Drive evaluation and deployment of security tooling, such as endpoint protection, network monitoring, and secrets management, and make build-vs-buy recommendations to executive leadership to strengthen the platform’s overall security posture.
• Design and lead security awareness training and documentation programs for internal teams handling sensitive resident data, and mentor junior security engineers.

Requirements

• 8+ years of experience in a cybersecurity engineering, security operations, or related technical security role, including experience leading investigations or mentoring other engineers, ideally at a B2B SaaS company.
• Deep, hands-on expertise with cloud security in AWS (preferred), Azure, or GCP, including IAM, network security groups, and logging/monitoring services, with a track record of designing security architecture at scale.
• Practical experience administering enterprise identity platforms - Microsoft Entra ID and Auth0 or equivalent - including SSO, MFA, conditional access, and privileged access management.
• Advanced experience with SIEM/EDR platforms (e.g., Splunk, CrowdStrike, Elastic) and vulnerability management tools, including tool selection and program ownership.
• Direct ownership of at least one full SOC 2 Type II or HIPAA audit cycle as the primary technical point of contact for auditors, including control design, evidence collection, and remediation of findings; working knowledge of ISO 27001 a plus.
• Hands-on experience conducting HIPAA Security Rule risk analyses and managing Business Associate Agreements and the security obligations they carry.
• Demonstrated ownership of secure software development practices, including threat modeling, code review, and CI/CD pipeline security, with experience setting standards adopted organization-wide.
• Strong scripting or automation experience (Python, Bash, or similar) to streamline and scale security operations.
• Excellent communication and executive presence, with the ability to present security risk, incident findings, and remediation plans to senior leadership, the board, and both technical and non-technical stakeholders.
• Advanced security certifications strongly preferred - CISSP or CISM, with HCISPP and CCSP valued for healthcare and cloud depth; GCIH, GCFA, GCFE, CEH, or CySA+ are a plus.
• Experience in healthcare, senior living, or another highly regulated industry strongly preferred; genuine interest in protecting sensitive resident and caregiver data is valued, along with prior experience mentoring or informally leading other security engineers.

Salary

$150,000 - $180,000 per year