Principal Security Engineer

Imagine Pediatrics is hiring a Principal Security Engineer to set the technical vision for protecting its systems, data, and the children and families it serves. The role leads security strategy and architecture, DevSecOps, incident response, compliance, and cross-functional security practices while mentoring engineers and advising leadership.

Responsibilities:

• Set the technical vision for the security stack, including endpoint, email, data loss prevention, vulnerability management and penetration testing, network, application, and data security, and ensure it aligns with business and clinical strategy
• Define long-term cloud and identity security strategy across Microsoft Azure/EntraID and Amazon Web Services (AWS), including privileged access, phishing-resistant MFA, and governance of non-human identities such as AI agents, service accounts, and API keys, shaping secure infrastructure design patterns that influence company-wide technical decisions
• Lead security architecture review and threat modeling for Care Hub and connected services, including Medplum application-layer controls (FHIR access policies, SMART scopes, Bots, and custom code) and data platforms such as Snowflake
• Define DevSecOps strategy and standardize security gates across the SDLC and CI/CD pipeline, building on GitHub Advanced Security, OWASP Top 10 practices, software bills of materials, and prioritization of CISA Known Exploited Vulnerabilities
• Serve as the senior technical escalation point (including in the on-call rotation) for the most complex and highest-stakes security events and strengthen incident playbooks, ransomware and critical-SaaS exercises, and restoration testing against recovery targets
• Monitor and advise on the evolving threat landscape facing healthcare including AI-enabled and agentic attacks and its implications for business strategy
• Ensure the organization can accurately demonstrate its security posture to payors, regulators, auditors, and other third parties, building documentation and evidence pipelines, including AI-assisted ones, that scale with our HITRUST, HIPAA, and NIST compliance requirements
• Frame ambiguous, high-stakes security questions for the organization and drive them to well-reasoned, defensible answers delivering decision-ready recommendations, risk rankings, and documented resolution pathways
• Ensure precision at the program level by driving guardrails such as automated configuration checks and drift detection, so misconfigurations are prevented systemically rather than caught individually
• Shape the technical sequencing of our multi-year security roadmap, contribute to quarterly engineering planning, and ensure the security program’s execution aligns with company strategy and the timelines that matter to the business
• Explore early-stage ideas and proofs of concept to de-risk future security initiatives before they are staffed or scoped
• Champion thoughtful AI adoption within security to reduce manual effort, and guide how AI tools and AI-enabled products are adopted securely across the company
• Partner with engineering, product, IT, and clinical stakeholders to embed security into how we design, build, and operate our digital products, translating complex security concepts for non-technical audiences
• Mentor the security engineering team, coach engineers across technology on security craftsmanship, and shape the team’s learning culture
• Act as a trusted advisor to leadership, advocating for security engineers while aligning security decisions with business priorities, and demonstrate executive-level composure in high-stakes, ambiguous situations
• Apply professional discretion and judgement when viewing sensitive and personal data or information in the process of conducting work
• Other duties as assigned

Requirements:

• First and foremost, you're passionate and committed to reimagining pediatric health care and creating a world where every child with complex medical conditions gets the care and support they deserve
• 10+ years of experience as a Security Engineer, Principal Security Engineer, Security Architect, or similar role(s), with at least 5 years of experience within the healthcare industry
• A track record of setting security technical strategy and driving alignment across security, IT, and engineering teams
• Deep expertise in cloud and identity security architecture across AWS and Microsoft Azure/EntraID
• Hands-on application and product security experience, including threat modeling, secure SDLC and CI/CD design, and securing healthcare APIs (FHIR, SMART on FHIR)
• Experience leading detection and response programs, including partnering with MDR providers and leading the technical response to serious security incidents and data breaches
• Extensive experience translating HITRUST and HIPAA Security Rule requirements into technical controls and supporting engagements with auditors, payors, and regulators
• Experience using Artificial Intelligence (AI) as a transformative technology to enhance and automate security processes, and an understanding of the security risks AI systems introduce
• Knowledge of IT systems such as AWS, Microsoft Intune, EntraID, CrowdStrike Falcon (EDR/SIEM), GitHub Advanced Security, Snowflake, JAMF, Meraki, and JIRA Service Management
• Strong collaboration and coaching skills, with demonstrated success developing senior engineers
• Comfort operating autonomously in ambiguity, exploring early-stage ideas without well-defined requirements
• Experience working in a fast-paced, hypergrowth, collaborative environment
• Bachelor of Science degree in Computer Science, Information Security, Business, Management, or a related field is desired
• advanced degree a plus
• CISSP, CCSP, CISM, GIAC (e.g., GCIH, GCLD, GSEC), AWS Certified Security – Specialty, Microsoft Certified: Cybersecurity Architect Expert preferred
• experience with Medplum is a plus
• Contributions to the broader security community, such as conference talks, publications, or industry threat intelligence sharing, are a plus