Lead Security & Compliance Engineer

Lead Security and Compliance Engineer (OpenSpecimen) Scope: 10+ years hands-on engineering role owning Linux infrastructure, AWS security, application hardening, penetration testing, and regulatory compliance frameworks, specifically for OpenSpecimen deployments and healthcare environments.

Responsibilities:

• Cloud and Infrastructure: Configure AWS security controls (IAM, KMS, CloudTrail, GuardDuty, VPC) and harden Linux hosts and container runtimes.
• Application Security: Secure OpenSpecimen web applications and Apache Tomcat configurations; implement encryption at rest and in transit.
• Offensive Security: Execute internal and external penetration tests, vulnerability assessments, and remediation tracking.
• Compliance and Healthcare Security: Manage SOC 2 Type II audit cycles, enforce HIPAA technical safeguards, secure ePHI data pipelines, and complete customer security questionnaires.

Requirements:

• Experience: 10+ years in information security, systems engineering, or DevSecOps, including hands-on security experience in healthcare or health-tech environments.
• Client Exposure: Mandatory experience working directly with US and EU enterprise clients on security, compliance, and audits.
• Technical Skills: Deep Linux administration, mandatory hands-on knowledge of AWS security components (such as CloudTrail, GuardDuty, IAM, and KMS), cryptography implementation, and Tomcat security.
• Security Testing: Practical penetration testing and vulnerability management execution.
• Compliance Knowledge: Direct management of SOC 2 Type II and HIPAA frameworks.