Senior Security Engineer

Hipp is an AI-native healthcare platform that modernizes operations for non-hospital healthcare providers. The Senior Security Engineer will lead product, cloud infrastructure, software development lifecycle, and internal security by designing controls, improving detection and response, supporting compliance, and partnering with engineering and leadership to secure systems and AI-enabled workflows.

Responsibilities:

• Own and evolve Hipp’s product and infrastructure security program
• Partner with engineering teams to embed security into system design, implementation, deployment, and operations
• Conduct architecture reviews, threat modeling, code reviews, and targeted security assessments
• Strengthen cloud security across identity and access management, network controls, secrets, encryption, logging, and workload configuration
• Build and improve vulnerability-management processes across applications, dependencies, containers, infrastructure, and endpoints
• Develop security monitoring, alerting, investigation, and incident-response capabilities
• Lead incident-response preparation, including playbooks, tabletop exercises, evidence collection, and post-incident improvement
• Improve authentication, authorization, tenant isolation, privileged-access, and least-privilege controls
• Partner with engineering to secure AI-agent tools, model integrations, retrieval systems, and access to sensitive data
• Assess AI-specific threats such as prompt injection, excessive agency, insecure tool use, sensitive-data disclosure, and untrusted retrieved content
• Support HIPAA and SOC 2 compliance through technically sound, sustainable controls and evidence
• Help respond to customer security reviews, questionnaires, and technical diligence
• Evaluate vendors and integrations for security and privacy risk
• Establish security standards, documentation, and engineering guidance that teams can apply without unnecessary friction
• Track security posture and risk through meaningful metrics
• Mentor engineers and build a strong security culture across the company

Requirements:

• Significant experience securing production SaaS, cloud, or data-intensive applications
• Strong knowledge of application security, cloud security, identity, network security, encryption, secrets management, and secure software development
• Experience with at least one major cloud platform such as AWS, GCP, or Azure
• Experience identifying and remediating common web, API, authentication, and authorization vulnerabilities
• Hands-on experience with threat modeling, vulnerability management, security testing, monitoring, or incident response
• Ability to review architecture and code, reason about realistic attack paths, and recommend practical mitigations
• Experience working with engineering teams to implement security controls without unnecessarily slowing product development
• Strong understanding of logging, detection, investigation, and response
• Sound judgment when prioritizing security risks in a fast-moving environment
• Clear written and verbal communication with both technical and non-technical audiences
• High ownership and comfort building systems and processes from an early stage
• Experience securing healthcare technology or systems handling protected health information
• Familiarity with HIPAA, SOC 2, HITRUST, NIST, or similar frameworks
• Experience with infrastructure as code, container security, CI/CD security, and software-supply-chain controls
• Experience with penetration testing, bug bounty programs, or adversarial security reviews
• Familiarity with modern AI and agent security risks
• Experience securing multi-tenant SaaS architectures
• Experience with endpoint security, device management, SSO, and internal corporate security
• Relevant security certifications are welcome
• Experience as an early security hire at a startup