{"id":4203509,"url":"https://alion.io/job/hireatomic-security-engineer-soc-2-hipaa-govtech","title":"Security Engineer (SOC 2 / HIPAA) | GovTech","company":{"id":2224,"name":"Hireatomic","domain":"hireatomic.com","url":"https://alion.io/company/hireatomic","size_band":null,"is_staffing_agency":true,"employer_type":"agency","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":174996,"max":210000,"currency":"USD","period":"year","gross":null,"usd_annual":210000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"FedRAMP","optional":false},{"name":"HIPAA","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"ISO 27001","optional":true},{"name":"NIST 800-53","optional":true},{"name":"TypeScript","optional":true}],"status":"live","first_seen_at":"2026-11-12T22:31:34Z","employer_posted_date":null,"last_verified_at":"2026-11-12T22:31:34Z","board_verified":false,"closed_at":null,"days_open":0,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":0},"description":"This a Full Remote job, the offer is available from: United States, Arizona (USA), Florida (USA), Georgia (USA), Iowa (USA), Kentucky (USA), Louisiana (USA), Missouri (USA), New Hampshire (USA), North Carolina (USA), North Dakota (USA), Tennessee (USA), Texas (USA), Utah (USA), Virginia (USA), Washington (USA), Wisconsin (USA), Wyoming (USA)\nCompany Overview:\nOur client is a venture-backed govtech startup that helps families find the benefit programs they qualify for, apply to several at once and stay enrolled as rules change. State agencies, Medicaid managed care organizations and employers pay for the platform. It now runs eligibility checks and applications across federal, state and local programs. Its customers are highly regulated, so security and privacy shape how the team builds. The team is small and fully remote across the U.S.\nYour Role:\nThis is not a \"review and advise\" security role. You build the controls yourself.\n\nState and federal buyers are asking for stricter security standards. Security and privacy are now core parts of the platform, not side projects.\n\nYou'll be the senior engineer and tech lead for the platform's security, privacy and compliance controls, and the technical partner to the Trust Product Manager. The PM owns requirements, governance and the roadmap. You own the architecture and the working systems.\n\nYou'll start with the engineering behind the existing SOC 2 Type II and HIPAA controls. Recurring manual work like access reviews and evidence collection moves into code.\n\nThen you'll lead the technical side of the company's NIST 800-series alignment..\n\nWhat you'll do\nIdentity & Production Access (primary focus)\nDesign how people and services sign in, what each role is allowed to do, and where secrets are stored.\n\nDecide how engineers get into production and who approves that access.\n\nWrite the design and the code, and agree on the requirements with the Trust PM.\n\nIsolation & Audit Logging\nKeep environments, tenants, workloads and sensitive data separate from each other.\n\nBuild audit logs and change history that show who did what, in a form outside auditors can test.\n\nSOC 2 Type II & HIPAA Controls\nKeep the technical controls working, and move access reviews and evidence pulls from manual steps into code.\n\nTake every technical audit finding through to closure, and work with auditors on their tests.\n\nSecure Delivery\nBuild the release path in CI/CD and infrastructure as code, with approvals before anything reaches production.\n\nPublish shared modules and reference implementations so other teams get the controls by default.\n\nThreat Modeling & Review\nRun threat models on critical workflows and turn each finding into an engineering requirement.\n\nReview security-sensitive code, infrastructure and architecture changes before they go live.\n\nIncident Readiness\nOwn logging, detection, runbooks and escalation paths on the engineering side.\n\nLead or support investigation and containment when an incident happens, and join tabletop exercises with the PM and leadership.\n\nNIST 800-series Path\nWith the PM, translate NIST requirements into controls and priorities.\n\nGive leadership a technical roadmap for state and federal environments, moving toward FedRAMP-aligned practices where they apply.\n\nYou Bring:\n7+ years of software engineering, including a few years as the senior or lead engineer on production systems. You've committed application and infrastructure code yourself in the last year or two.\n\nHands-on SOC 2 Type II and HIPAA experience: controls you implemented and ran through an audit, and a system holding protected health information that you built or operated.\n\nCloud-native production experience, ideally on AWS, including infrastructure as code, CI/CD pipelines with approval steps, and environments you set up yourself.\n\nIdentity and access systems you designed: authentication, role- or attribute-based authorization, service identities, secrets management, production access controls and audit logging.\n\nThreat modeling carried through to shipped controls, and audit, pen-test or incident findings you closed yourself.\n\nGood judgment on what to enforce in software and what to leave as a process, and the ability to explain that trade-off to a product lead, an auditor and an engineer.\n\nComfort working autonomously while the architecture and operating model are still taking shape.\n\nYou must be based in the U.S.\n\nBonus points:\nNIST 800-53 or other 800-series controls you mapped to real system changes\n\nFedRAMP or ISO 27001 experience, even on one part of a system\n\nAutomated evidence collection or continuous control monitoring that an auditor accepted\n\nIncident-response runbooks you wrote, or a tabletop exercise you ran\n\nNode, TypeScript and AWS in the same production environment\n\nSoftware built for government, healthcare or fintech customers\n\nWhat They Offer:\nA fully remote role within the U.S.\n\n$14,583-$17,500 USD/month, depending on experience\n\nFull-time employment through an Employer of Record (EOR)\n\nReal technical ownership: the design decisions, and the order in which controls get built, are yours\n\nDirect collaboration with Product & Engineering leadership in a small, fast-growing team\n\nMission-driven impact: your work protects the data of families who rely on public benefits\n\nInterview Process:\n1⃣ Application review (resume and a few questions)\n2⃣ 30-minute screening call with Atomic HR about what you've built and what you want next\n3⃣ Profile shared with the hiring manager, who decides whom to meet. We'll update you either way.\n4⃣ Interviews with the hiring manager covering your access, audit logging and isolation designs, how you run threat models, and how you decide which controls to build now\n5⃣ Offer","description_format":"text","description_chars":5728,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Digital Government","Information Security","Incident Response","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-11-12T23:00:56Z"}],"visa":[],"liveness":{"score":52,"band":"ok","label":"Likely open","p_open":1,"p_active":0.516,"p_room":1,"age_days":0,"expected_fill_days":27,"reasons":["seen:0","agency","win:early"],"computed_at":"2026-11-13T02:11:35Z"},"pay":{"stated_usd_annual":210000,"is_top_pay":true},"html_url":"https://alion.io/job/hireatomic-security-engineer-soc-2-hipaa-govtech","json_url":"https://alion.io/job/hireatomic-security-engineer-soc-2-hipaa-govtech.json","meta":{"generated_at":"2026-11-13T02:11:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4564,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2224},"rest":"https://alion.io/mcp/rest/get_company?id=2224"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhireatomic-security-engineer-soc-2-hipaa-govtech"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhireatomic-security-engineer-soc-2-hipaa-govtech"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhireatomic-security-engineer-soc-2-hipaa-govtech"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/hireatomic-security-engineer-soc-2-hipaa-govtech\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhireatomic-security-engineer-soc-2-hipaa-govtech"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4203509}},{"tool":"search_jobs","arguments":{"company":"hireatomic.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4203509},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}