Lead Security Engineer

We are hiring a Security Lead for a fast-growing GenAI-native healthcare technology company building AI-powered solutions to transform healthcare revenue assurance. As the organisation continues to scale its AI-powered healthcare platform and enterprise customer base, security is a critical part of protecting sensitive healthcare data, maintaining regulatory compliance and building customer trust.

We are looking for a Security Lead to take end-to-end ownership of security across the organisation. This is a hands-on, high-ownership individual contributor role combining Security Architecture, GRC, Compliance, Risk Management, Cloud Security, Vendor Management and AI/LLM Security. This is a solo IC role with no direct reports, so we are looking for someone comfortable operating independently, making decisions and executing hands-on rather than relying on a team to delegate work to.

Responsibilities:

• Own and continuously improve HITRUST and SOC2 security programs.
• Drive security and risk management within a regulated healthcare environment.
• Build or significantly improve security infrastructure in a cloud-native environment across GCP, AWS or Azure.
• Develop structured security risk assessments and translate technical risks into cost-vs-risk recommendations for non-technical leadership.
• Evaluate, scope and manage external security vendors and consultants, including risk assessment and delivery accountability.
• Assess security risks associated with AI/LLM products and systems.
• Establish governance and controls around internal LLM usage and AI-powered workflows.
• Evaluate security considerations for agentic AI systems, including tool-calling and multi-step workflows.
• Contribute to security architecture across IAM, secrets management, network segmentation and secure SDLC.
• Own security processes including customer security questionnaires, risk assessments and security reviews.
• Establish and maintain security processes, controls and runbooks as the organisation scales.
• Make pragmatic security decisions by balancing business impact, cost, customer trust and security risk.

Requirements:

• 7+ years of experience in Security, with at least 3+ years working in a regulated environment such as healthcare, finance or government.
• Demonstrated experience operating and maintaining HITRUST or SOC2 programs, not just participating in a one-time certification or audit.
• Experience with structured risk quantification and presenting cost-vs-risk recommendations to non-technical leadership.
• Experience building or significantly improving security infrastructure in a cloud-native environment using GCP, AWS or Azure.
• Experience evaluating and managing external security vendors/consultants, including scoping, risk assessment and delivery accountability.
• Hands-on AI/LLM security experience, such as assessing risks in an AI product, governing internal LLM usage or implementing controls for LLM/agentic systems.
• Demonstrated ability to make cost-vs-risk tradeoffs and recommend against approaches when the risk does not justify the cost.
• Comfortable working as a solo security IC, with recent hands-on technical security experience rather than a purely managerial background.

Good to Have:

• Experience with SOC2 Type II operational programs.
• CISSP, CISM, CCSP or equivalent certification.
• Familiarity with healthcare EHR security and integrations such as HL7 FHIR, Epic or Athena.
• Experience securing or assessing agentic AI systems and multi-step AI workflows.
• Experience working in a high-growth startup environment, particularly Series A-C companies.
• Experience handling enterprise customer security reviews, questionnaires and CISO/trust discussions.
• Experience with GCP, particularly in a healthcare/cloud-native environment.
• Experience with multi-tenant or multi-BAA architecture patterns.
• Security awareness or training program experience.
• Publications, conference talks or security research experience.