Principal Security Engineer

About Avalon Healthcare Solutions:

Avalon Healthcare Solutions is the nation’s leader in diagnostic intelligence, uniquely focused on transforming the role of diagnostic testing across the healthcare ecosystem. Our proprietary Diagnostic Insights Platform delivers evidence-based policies, curated lab networks, and real-time analytics that simplify complex diagnostics, accelerate innovation adoption, and optimize diagnostic investments.

Supporting over 30 health plans and 100 million members nationwide, Avalon partners with payers and providers to ensure diagnostic testing is performed appropriately, efficiently, and at the right time. Our flexible solutions span routine and genetic testing management, automated adherence, and end-to-end diagnostics support-driving measurable value, reduced waste, and improved clinical outcomes.

With unmatched scientific rigor, deep clinical expertise, and a performance-based model, Avalon is redefining how diagnostics power personalized care and healthcare value. You will be part of a team that shapes a new market and business. Most importantly, you will help Avalon to achieve its mission and improve clinical outcomes and health care affordability for the people we serve.

For more information about Avalon, please visit www.avalonhcs.com.

Avalon Healthcare Solutions is an Equal Opportunity Employer - Vet/Disability.

This position description is subject to change at any time. As determined by the company based upon business needs, an employee in this position may be required to perform duties and take responsibility for work other than as described in this document.

About the Principal Security Engineer Position:

The Principal Security Engineer serves as the organization's senior technical authority for cloud, application, data, and enterprise security, providing strategic leadership and engineering expertise in support of Avalon's information security, technology, and business objectives. This role is responsible for defining security architecture, establishing security engineering standards, identifying and mitigating systemic risk, and leading the design and implementation of enterprise security controls across a predominantly AWS-based healthcare technology environment.

The Principal Security Engineer partners closely with Information Security, Platform Engineering, Cloud Operations, Platform Reliability, Software Engineering, Data Engineering, and Enterprise Architecture teams to ensure security requirements are effectively integrated into technology solutions and operational processes. This position is responsible for translating regulatory, compliance, and organizational security requirements, including HITRUST and HIPAA standards, into scalable technical controls that support secure, reliable, and compliant business operations.

As a senior individual contributor and subject matter expert, the Principal Security Engineer leads complex security initiatives, drives the implementation of security controls and remediation efforts, and provides technical leadership to support secure, resilient, and compliant technology solutions across the organization.

This position is eligible for remote work, but quarterly travel will be required to Avalon’s corporate office located in Tampa, Florida.

Principal Security Engineer - Essential Functions and Responsibilities:

Cloud Security Architecture

• Serve as a senior technical authority for security across a multi-account AWS environment.
• Design and maintain security architecture for AWS Organizations, Control Tower, IAM, VPCs, EC2, ECS/Fargate, S3, Lambda, API Gateway, RDS, OpenSearch, Bedrock and other AWS services.
• Establish and improve AWS account, OU, network, workload and security boundaries.
• Design preventative controls using Service Control Policies (SCPs), IAM policies, permission boundaries, resource policies and AWS Config controls.
• Develop secure patterns for IAM roles, cross-account access, workload identities and privileged administrative access.
• Review cloud architectures and provide practical security guidance during design rather than relying exclusively on post-deployment findings.
• Develop strategies for workload isolation, network segmentation, private connectivity and controlled Internet egress.
• Establish security patterns for emerging workloads including AI/ML and generative AI.

Security Engineering & Automation

• Build security controls using Terraform.
• Develop automated detection and remediation for common security findings.
• Integrate security controls with Snyk into CI/CD and deployment pipelines.
• Partner with Platform Reliability and Cloud Operations to make security remediation part of normal engineering operations.
• Develop reusable security modules, policies and reference architectures.
• Automate evidence collection and technical compliance validation where practical.

Detection, Response & Vulnerability Management

• Provide senior technical leadership during security incidents and complex investigations.
• Improve detection capabilities using AWS Security Hub, GuardDuty, CloudTrail, CloudWatch, Datadog/SIEM and related telemetry.
• Develop security monitoring and alerting standards with a focus on actionable signals rather than alert volume.
• Provide security architecture and engineering guidance for Snowflake and AWS-hosted data platforms.
• Partner with GRC to provide technical interpretation of control requirements.

Technical Leadership

• Partner with Avalon principals in other tech areas to audit, evolve, and grow our technical standards, representing the security perspective.
• Provide mentorship and education to help the entire IT organization grow their security knowledge and skills.

AI & Emerging Technology Security

• Develop security architecture and guardrails for Amazon Bedrock, open-weight models and other generative AI technologies.
• Develop patterns for isolating AI workloads and protecting PHI and proprietary information.
• Evaluate risks involving model access, prompt/data leakage, third-party model providers and AI supply chains.
• Drive difficult technical problems through investigation, design, implementation and operational adoption.
• Raise the security capabilities of engineering teams through documentation, automation and reusable patterns.
• Remain hands-on with technology while providing organization-level technical leadership.

Principal Security Engineer - Minimum Qualifications:

• Minimum years of relevant work experience: 6+ years in security engineering, cloud engineering, infrastructure engineering, DevSecOps, or related disciplines.
• Required certification: None required.
• Significant hands-on experience securing production AWS environments.
• Deep understanding of AWS IAM, Organizations, SCPs, VPC networking, KMS, S3 and workload security.
• Experience securing EC2, containerized and serverless workloads.
• Strong understanding of network security, identity, encryption and secrets management.
• Experience with infrastructure-as-code such as Terraform or CloudFormation.
• Experience integrating security controls into CI/CD pipelines.
• Strong scripting or software automation capabilities.
• Experience with vulnerability management and security remediation.
• Experience with security monitoring, logging and incident investigation.
• Ability to independently analyze complex architectures and identify meaningful security risks.

Principal Security Engineer - Preferred Qualifications:

• Experience operating in a healthcare, financial services or similarly regulated environment.
• Practical experience with HITRUST and HIPAA.
• Experience securing Snowflake.
• Experience with AWS Security Hub, GuardDuty, CloudTrail, AWS Config and Control Tower.
• Experience with container security involving ECS, Fargate, EKS or Kubernetes.
• Experience with Datadog, SIEM platforms or enterprise observability systems.
• Experience with Harness or comparable CI/CD platforms.
• Experience with Tenable, CrowdStrike or similar vulnerability and endpoint security technologies.
• Experience designing multi-account AWS security architectures.
• Experience with AWS Backup, immutable storage and disaster-recovery security controls.
• Experience securing Bedrock, generative AI or self-hosted/open-weight AI models.
• Experience developing automated security remediation.
• AWS Security Specialty, AWS Solutions Architect Professional, CISM, CISSP or comparable certifications are beneficial but not required.