Senior Cloud Security Engineer

COMPANY OVERVIEW: HealthMark Group is a leading provider of health IT solutions for healthcare providers across the country. By leveraging technology to reimagine the business of healthcare, HealthMark transforms administrative processes into seamless digital solutions. From HealthMark’ s proprietary MedRelease platform for Release of Information, the company is pioneering an efficient, compliant, and patient-centric approach to support the entire spectrum of the patient information journey. HealthMark Group was founded in 2006 with corporate headquarters in Dallas, TX, and has been named to both the Dallas 100 and the Inc. 5000 for multiple years in a row as one of the fastest-growing companies in the region and the country.

We are a mid-sized company in a transformation phase: modernizing legacy systems, building new products, and automating workflows that used to require rooms full of people. If you want to build things that matter (not just maintain them), this is a good time to join.

Position: Senior Cloud Security Engineer

Location: Remote

Role Overview:

The senior cloud security engineer is responsible for designing, implementing, and maintaining security controls for HealthMark Group developed applications and corporate systems, with a focus on the AWS cloud environment, including the platforms supporting our medical imaging business. They define AWS security guardrails appropriate for a highly-regulated environment containing Protected Health Information (PHI) and which must adhere to security regulations and frameworks such as HIPAA, HITRUST, and SOC 2. They serve as a leader in the Security Operations team, providing mentorship and guidance to fellow security engineers.

Primary Roles and Responsibilities :

• Design and build enterprise-grade security controls utilizing native AWS services to safeguard PHI across all cloud environments.
• Design and maintain the secure multi-account AWS architecture - account structure, organizational units, guardrails, and baseline configuration - so that new accounts and workloads inherit required PHI protections by default.
• Author, review, and maintain secure-by-default Terraform or AWS CloudFormation templates, integrating policy-as-code tools (e.g., OPA, Checkov, Rego) to programmatically enforce HIPAA, HITRUST, and SOC 2 controls before deployment.
• Align and enforce strict data-at-rest and data-in-transit encryption strategies utilizing AWS KMS, ensuring cryptographic standards satisfy HITRUST and HIPAA mandates for PHI.
• Design and enforce strict least-privilege access models, complex IAM policies, Service Control Policies (SCPs), and AWS Organizations boundaries to strictly control access to sensitive healthcare workloads.
• Embed security testing, container scanning, and secrets management (AWS Secrets Manager) directly into CI/CD pipelines, creating automated evidence-collection workflows for continuous SOC 2 and HITRUST audit readiness.
• Collaborate with application development and cloud operations teams to triage, investigate, and remediate vulnerabilities and findings from application and cloud security tooling, such as SAST, DAST, and CSPM.
• Develop custom detection rules using AWS CloudTrail, Amazon CloudWatch telemetry, and enterprise SIEM tool to monitor system activities to detect and respond to threats and incidents.
• Serve as the senior escalation point for cloud security incidents, leading investigation and containment in AWS environment in partnership with our Managed Detection and Response provider, Cloud Operations team, and Managed Services Provider. Drive post-incident root cause analysis and control improvements.
• Support third-party risk assessment and security certification processes through evidence collection and response to security questionnaires.
• Evaluate and document cloud security exceptions and compensating controls, partnering with GRC to ensure risk acceptance decisions are appropriately assessed, approved, and tracked to closure.
• Lead the security integration of newly acquired platforms into HealthMark Group's cloud security architecture - assessing inherited environments, closing control gaps, and bringing workloads into HIPAA, HITRUST, and SOC 2 scope.
• Provide technical mentorship to security engineers on secure cloud design, automation, and investigative technique, and support design reviews for new and changing AWS workloads.
• Develop and maintain cloud security documentation, defining architecture standards, runbooks, and incident response procedures for an evolving environment.
• Define and report cloud security metrics on a recurring basis to measure control coverage, posture drift, vulnerability management, and audit-readiness in the cloud environment.
• Contribute cloud and application security expertise to enterprise security awareness and developer training efforts.
• Stay up to date with industry trends and advancements in attacks and remediations, making recommendations to position our defenses appropriately.
• Provide other support to HealthMark Group Security Operations as required.

Required Experience and Qualifications:

• Minimum of 5 to 7 years of dedicated experience in cybersecurity, infrastructure engineering, or DevOps, with at least 3 years focused strictly on AWS compliance-driven engineering.
• Deep, hands-on knowledge of core AWS services commonly holding or routing PHI (VPC, IAM, EC2, S3, RDS, Lambda, EKS) and supporting services essential for the maintenance of a secure cloud environment.
• Hands-on experience securing and hardening Linux systems and Linux-based cloud workloads, including access control, logging, patching, and benchmark-based configuration standards.
• Strong working knowledge of HIPAA regulations, HITRUST CSF requirements, SOC 2 trust services criteria, or similar frameworks within a cloud context.
• Demonstrated experience with cloud detection engineering and security incident response, including investigation and containment in AWS using CloudTrail, CloudWatch, and SIEM telemetry.
• Advanced, production-level experience deploying and managing AWS infrastructure securely via Terraform or AWS CloudFormation, including policy-as-code enforcement and security integration into CI/CD pipelines.
• Strong proficiency in scripting and automation using PowerShell, Python (Boto3), or similar to automate compliance evidence gathering and remediation tasks.
• Great communicator with the ability to relay critical information to engineering teams, executive leadership, and external assessors promptly and effectively.
• Strong troubleshooting and analytic ability to track and solve intricate problems across technical systems, such as servers, databases, developed applications, and network infrastructure, including issues spanning platforms and ownership boundaries.
• Bachelor’s degree in Computer Science, Information Security, or equivalent practical engineering experience.

Additional Preferred Experience:

• AWS Certified Security - Specialty
• Certified Information Systems Security Professional (CISSP) or Certified Cloud Security Professional (CCSP)
• HITRUST Certified CSF Practitioner (CCSFP)
• Experience with security and maintenance of Microsoft systems, including Windows operating system, M365, Entra, and Active Directory
• Strong experience with networking and security in physical and hybrid environments, in addition to cloud
• Familiarity with medical imaging or healthcare interoperability technologies (DICOM, PACS, HL7/FHIR).
• Experience securing environments through mergers, acquisitions, or platform integrations.

Note: This job description is intended to provide a general overview of the position and does not encompass all job-related responsibilities and requirements. The responsibilities and qualifications may be subject to change as the needs of the organization evolve.

This role does or may require regular access to Protected Health Information (PHI) and/or confidential client data. The incumbent must demonstrate a strong understanding of confidentiality requirements, adhere to all HIPAA regulations and organizational privacy and security policies, and report any known or suspected unauthorized access, use, or disclosure of PHI immediately to the Privacy Officer or Information Security team. This position requires timely completion of all required company-sponsored and regulatory training programs