Principal Security Engineer

Avalon Healthcare Solutions is hiring a Principal Security Engineer to provide strategic technical leadership and engineering expertise across cloud, application, data, and enterprise security. The role defines security architecture and engineering standards, mitigates systemic risk, and leads enterprise security controls in a predominantly AWS-based healthcare technology environment.

Responsibilities:

• Serve as a senior technical authority for security across a multi-account AWS environment
• Design and maintain security architecture for AWS Organizations, Control Tower, IAM, VPCs, EC2, ECS/Fargate, S3, Lambda, API Gateway, RDS, OpenSearch, Bedrock and other AWS services
• Establish and improve AWS account, OU, network, workload and security boundaries
• Design preventative controls using Service Control Policies (SCPs), IAM policies, permission boundaries, resource policies and AWS Config controls
• Develop secure patterns for IAM roles, cross-account access, workload identities and privileged administrative access
• Review cloud architectures and provide practical security guidance during design rather than relying exclusively on post-deployment findings
• Develop strategies for workload isolation, network segmentation, private connectivity and controlled Internet egress
• Establish security patterns for emerging workloads including AI/ML and generative AI
• Build security controls using Terraform
• Develop automated detection and remediation for common security findings
• Integrate security controls with Snyk into CI/CD and deployment pipelines
• Partner with Platform Reliability and Cloud Operations to make security remediation part of normal engineering operations
• Develop reusable security modules, policies and reference architectures
• Automate evidence collection and technical compliance validation where practical
• Provide senior technical leadership during security incidents and complex investigations
• Improve detection capabilities using AWS Security Hub, GuardDuty, CloudTrail, CloudWatch, Datadog/SIEM and related telemetry
• Develop security monitoring and alerting standards with a focus on actionable signals rather than alert volume
• Provide security architecture and engineering guidance for Snowflake and AWS-hosted data platforms
• Partner with GRC to provide technical interpretation of control requirements
• Partner with Avalon principals in other tech areas to audit, evolve, and grow our technical standards, representing the security perspective
• Provide mentorship and education to help the entire IT organization grow their security knowledge and skills
• Develop security architecture and guardrails for Amazon Bedrock, open-weight models and other generative AI technologies
• Develop patterns for isolating AI workloads and protecting PHI and proprietary information
• Evaluate risks involving model access, prompt/data leakage, third-party model providers and AI supply chains
• Drive difficult technical problems through investigation, design, implementation and operational adoption
• Raise the security capabilities of engineering teams through documentation, automation and reusable patterns
• Remain hands-on with technology while providing organization-level technical leadership

Requirements:

• Minimum years of relevant work experience: 6+ years in security engineering, cloud engineering, infrastructure engineering, DevSecOps, or related disciplines
• Significant hands-on experience securing production AWS environments
• Deep understanding of AWS IAM, Organizations, SCPs, VPC networking, KMS, S3 and workload security
• Experience securing EC2, containerized and serverless workloads
• Strong understanding of network security, identity, encryption and secrets management
• Experience with infrastructure-as-code such as Terraform or CloudFormation
• Experience integrating security controls into CI/CD pipelines
• Strong scripting or software automation capabilities
• Experience with vulnerability management and security remediation
• Experience with security monitoring, logging and incident investigation
• Ability to independently analyze complex architectures and identify meaningful security risks
• Experience operating in a healthcare, financial services or similarly regulated environment
• Practical experience with HITRUST and HIPAA
• Experience securing Snowflake
• Experience with AWS Security Hub, GuardDuty, CloudTrail, AWS Config and Control Tower
• Experience with container security involving ECS, Fargate, EKS or Kubernetes
• Experience with Datadog, SIEM platforms or enterprise observability systems
• Experience with Harness or comparable CI/CD platforms
• Experience with Tenable, CrowdStrike or similar vulnerability and endpoint security technologies
• Experience designing multi-account AWS security architectures
• Experience with AWS Backup, immutable storage and disaster-recovery security controls
• Experience securing Bedrock, generative AI or self-hosted/open-weight AI models
• Experience developing automated security remediation
• AWS Security Specialty, AWS Solutions Architect Professional, CISM, CISSP or comparable certifications are beneficial but not required