Staff Cloud Security Engineer

AnswersNow

United States

Remote

USD 151,000 - 179,000

Full time

3 hours ago

Be an early applicant

Application generator

A complete application in a minute — tailored resume and cover letter, ready to send.

Get past ATS filters

Benefits offered by this job

Remote-first

Equity options

Medical, dental, vision

Generous PTO

Job summary

AnswersNow seeks a Staff Cloud Security Engineer to own security across the platform, infrastructure, and corporate environment. You will set strategy, build the program, and perform hands-on work, partnering with the CTO and engineering team.

This role is autonomous, influences risk decisions, and aims to elevate the organization's security maturity. You’ll lead SOC 2 and HIPAA readiness, AI governance, and incident response while shaping security as a core capability.

Qualifications

8+ years of security engineering experience, with hands-on cloud security.
Experience securing production cloud environments, preferably AWS-heavy.
Strong background in application and API security, with code/architecture reviews.

Responsibilities

Architect, secure, and harden AWS environments (IAM, VPC, KMS, logging, WAF).
Secure serverless/data layers (Lambda, S3, PostgreSQL) with encryption and least-privilege access.
Implement IaC security guardrails and policy-as-code.
Own secrets management and certificate lifecycle.
Harden EKS infrastructure, including cluster security and network policies.
Secure APIs, auth, session management, and OWASP/API Top 10.
Embed security into SDLC with threat modeling, SAST/DAST, scanning, and CI/CD security.
Secure real-time video platform (WebRTC) and media transport.
Oversee vulnerability management and pen-testing program.

Skills

Security engineering

AWS security

PostgreSQL security

Application security

SOC 2 / HIPAA compliance

Infrastructure as Code

CI/CD security

AI security

Incident response

Clear communication

Tools

Pulumi

CloudFormation

CDK

Job description

Remote, Anywhere in the US

We’re looking for a Staff Cloud Security Engineer who thrives on designing scalable, secure cloud systems and enabling data-driven decision-making.

About AnswersNow:

AnswersNow is a venture-backed digital health company delivering virtual autism care to families. Our mission is to empower and enhance the lives of those affected by autism by making personalized therapy more accessible. We connect families with expert clinicians quickly - often moving from assessment to therapy within weeks, without waitlists or commutes - and deliver outcomes that parents describe as life-changing.

Why this role matters:

This is our first dedicated security hire and the single owner of security across our platform, infrastructure, and corporate environment. You'll set the strategy, build the program, and do the hands-on work. You'll partner directly with the CTO and engineering team, and you'll be the technical authority on security for customers, auditors, and leadership.

This is a Staff-level role. We expect you to operate with significant autonomy, make sound risk-based tradeoffs, and raise the security maturity of the whole organization.

What you’ll do:

Cloud & Infrastructure Security

Architect, secure, and continuously harden our AWS environment (IAM, VPC design, KMS, CloudTrail, GuardDuty, Security Hub, Config, WAF, etc.)
Secure our serverless and data layers, including Lambda, S3, and PostgreSQL (RDS/Aurora): encryption at rest and in transit, least-privilege access, network isolation, backup integrity, and audit logging
Implement Infrastructure-as-Code security guardrails and policy-as-code
Own secrets management, key management, and certificate lifecycle
Manage and harden Amazon Elastic Kubernetes Service (EKS) infrastructure, including cluster security, network policies, and container runtime security

Application & API Security

Secure our APIs and application stack: authentication/authorization, session management, rate limiting, input validation, and OWASP Top 10 / API Top 10 risks
Embed security into the SDLC with threat modeling, secure design reviews, SAST/DAST, dependency and container scanning, and CI/CD pipeline security
Secure our proprietary real-time video platform (WebRTC/media transport, session access controls, recording storage, and encryption)
Run our vulnerability management and penetration testing program, including vendor selection, scoping, and remediation tracking

AI Security & Governance

Establish company-wide AI usage policies and governance frameworks to ensure safe, ethical, and compliant adoption of internal and third-party AI tools
Architect and secure in-product AI/ML capabilities, protecting against OWASP LLM Top 10 vulnerabilities (e.g., prompt injection, insecure output handling, data poisoning)
Implement strict data privacy guardrails to prevent unauthorized exposure of PHI/PII in model training, fine-tuning, and prompt contexts
Define and enforce model security controls, securing model artifacts, API endpoints, supply chain dependencies, and access controls
Build continuous monitoring, telemetry, and comprehensive audit logging across all AI/ML workflows to support compliance, threat detection, and incident response

Compliance (SOC 2 & HIPAA)

Own our path to SOC 2 Type I and Type II: scoping, control design, evidence collection, auditor selection and management, and ongoing readiness
Own ongoing HIPAA Security Rule compliance, including risk assessments, policies, BAAs, breach notification procedures, and audit readiness
Get the most from Vanta: tune integrations, automate evidence collection, and drive remediation of failing tests
Maintain the security policy library, risk register, and vendor risk management program
Support customer and payer security questionnaires and due diligence

Endpoint & Corporate Security

Work with outsourced IT to manage security for laptops and workstations: MDM, disk encryption, EDR, patching, hardening baselines, and device compliance
Own identity and access management: SSO, MFA, RBAC, joiner/mover/leaver processes, and periodic access reviews
Work with People ops to run security awareness and HIPAA training programs

Detection, Response & Resilience

Build logging, monitoring, and alerting for the platform and corporate environment (SIEM or equivalent)
Develop and test our incident response plan, run tabletop exercises, and lead response when incidents occur
Partner with engineering on disaster recovery, backup, and business continuity planning

Leadership

Define the security roadmap and communicate risk clearly to the CTO and executive team
Mentor engineers and build a security-conscious culture, such as a security champions model
Build the business case for tools, vendors, and (eventually) additional security headcount

What you bring:

8+ years in security engineering, with significant hands-on experience securing production cloud environments, ideally AWS-heavy
Deep AWS security expertise (IAM, networking, encryption/KMS, logging and detection services, serverless security)
Experience securing PostgreSQL and other data stores containing regulated or sensitive data
Strong application and API security background, and the ability to review code and architecture and work effectively with developers
Direct experience owning or leading a SOC 2 audit (Type I and/or Type II) and HIPAA compliance, ideally in a healthcare or health-tech environment handling PHI
Experience with Infrastructure-as-Code (Pulumi, CloudFormation, or CDK) and CI/CD security
Experience with AI security, LLM application security, and guarding against OWASP LLM Top 10 vulnerabilities
Strong incident response experience
Excellent communication: you can explain risk to engineers, executives, auditors, and customers alike

Nice to have:

Experience with compliance automation platforms such as Vanta, Drata, or Secureframe
Experience securing real-time communication or video platforms (WebRTC)
Familiarity with HITRUST, ISO 27001, or NIST frameworks
Experience at a startup or scale-up where you built a security program from scratch
Relevant certifications (AWS Security Specialty, CISSP, CCSP, OSCP, or similar)
Experience with pediatric or behavioral health data and the added privacy considerations that come with minors' information

What we offer: