The ad says“You will drive two key initiatives: building a cohesive AWS foundation with Terraform, Control Tower, and AFT, and owning end-to-end security engineering for our production PHI and Bedrock AI workloads”
The ad says“Partnership with application engineers on Lambda, Aurora PostgreSQL, and Bedrock workloads”
The ad says“You will drive two key initiatives: building a cohesive AWS foundation with Terraform, Control Tower, and AFT, and owning end-to-end security engineering for our production PHI and Bedrock AI workloads”
The ad says“CloudFormation/CDK/Serverless-to-Terraform migration experience”
The ad says“Identity and access governance. IAM Identity Center, cross-account roles, SSO, periodic access reviews, and joiner/mover/leaver deprovisioning, alongside network foundations: VPC design, WAF, and Client VPN”
The ad says“CloudFormation/CDK/Serverless-to-Terraform migration experience”
The ad says“Observability and cost visibility: CloudWatch, alarms, dashboards, tagging”
The ad says“Security engineering. Security Hub, GuardDuty, Inspector, and Config as living detection tooling: triage findings, tune signals, and run the vulnerability lifecycle from discovery through verified fix. Coordinate penetration tests and own remediation”
The ad says“You will drive two key initiatives: building a cohesive AWS foundation with Terraform, Control Tower, and AFT, and owning end-to-end security engineering for our production PHI and Bedrock AI workloads”
The ad says“HITRUST, NIST 800-53, or CSA STAR exposure”
The ad says“Compliance automation platforms (Drata, Vanta) including evidence automation”
The ad says“Pipeline and supply chain security. Secure the commit-to-production path in GitHub Actions: least-privilege OIDC deployment roles, secrets scanning, SAST and dependency/container gates, branch protection, and artifact integrity”
The ad says“Security engineering. Security Hub, GuardDuty, Inspector, and Config as living detection tooling: triage findings, tune signals, and run the vulnerability lifecycle from discovery through verified fix. Coordinate penetration tests and own remediation”
The ad says“HITRUST, NIST 800-53, or CSA STAR exposure”
The ad says“Identity and access governance. IAM Identity Center, cross-account roles, SSO, periodic access reviews, and joiner/mover/leaver deprovisioning, alongside network foundations: VPC design, WAF, and Client VPN”
The ad says“Security engineering. Security Hub, GuardDuty, Inspector, and Config as living detection tooling: triage findings, tune signals, and run the vulnerability lifecycle from discovery through verified fix. Coordinate penetration tests and own remediation”
The ad says“Partnership with application engineers on Lambda, Aurora PostgreSQL, and Bedrock workloads”
The ad says“HITRUST, NIST 800-53, or CSA STAR exposure”
The ad says“Python or TypeScript for automation”
The ad says“Security engineering. Security Hub, GuardDuty, Inspector, and Config as living detection tooling: triage findings, tune signals, and run the vulnerability lifecycle from discovery through verified fix. Coordinate penetration tests and own remediation”
The ad says“You will drive two key initiatives: building a cohesive AWS foundation with Terraform, Control Tower, and AFT, and owning end-to-end security engineering for our production PHI and Bedrock AI workloads”
The ad says“Python or TypeScript for automation”
The ad says“Compliance automation platforms (Drata, Vanta) including evidence automation”
The ad says“Identity and access governance. IAM Identity Center, cross-account roles, SSO, periodic access reviews, and joiner/mover/leaver deprovisioning, alongside network foundations: VPC design, WAF, and Client VPN”
The ad says“Identity and access governance. IAM Identity Center, cross-account roles, SSO, periodic access reviews, and joiner/mover/leaver deprovisioning, alongside network foundations: VPC design, WAF, and Client VPN”
Join our small, high-trust Infrastructure team as its second engineer, reporting to the Director of Infrastructure and partnering closely with our product engineering team
You will drive two key initiatives: building a cohesive AWS foundation with Terraform, Control Tower, and AFT, and owning end-to-end security engineering for our production PHI and Bedrock AI workloads
Just as important, you’ll build the paved paths, self-service tooling, and guardrails that let our engineers ship quickly
AI is deeply embedded in how we work
We use it across coding, testing, and operations, not because of a mandate but because we’ve seen what it unlocks
We’re looking for someone who already builds this way and is curious about what AI-augmented practice looks like in infrastructure and security work
We value fast decisions, open feedback, and empowered engineers
Infrastructure as code. The Terraform codebase - module design, state strategy, drift detection, plan review discipline - and the migration of our CloudFormation/Serverless footprint where it delivers real leverage, without stalling product delivery
The AWS landing zone. Multi-account structure via Control Tower and AFT: account vending, customizations, service control policies, and OU design
Security engineering. Security Hub, GuardDuty, Inspector, and Config as living detection tooling: triage findings, tune signals, and run the vulnerability lifecycle from discovery through verified fix. Coordinate penetration tests and own remediation
Pipeline and supply chain security. Secure the commit-to-production path in GitHub Actions: least-privilege OIDC deployment roles, secrets scanning, SAST and dependency/container gates, branch protection, and artifact integrity
Developer enablement. Paved-path tooling, self-service infrastructure, and secure defaults that let product engineers move fast without filing tickets
Disaster recovery and backup. Backup strategy, RPO/RTO targets, Aurora point-in-time recovery, and regular DR testing to satisfy HIPAA contingency planning requirements
Compliance as code. SOC 2 and HIPAA controls encoded into the platform - encryption, KMS, CloudTrail/Config coverage, log retention - with automated evidence collection
Identity and access governance. IAM Identity Center, cross-account roles, SSO, periodic access reviews, and joiner/mover/leaver deprovisioning, alongside network foundations: VPC design, WAF, and Client VPN
Security architecture for Bedrock AI workloads: access controls, guardrails, PHI data boundaries
Production incident response (reliability and security) and recurrence prevention
Observability and cost visibility: CloudWatch, alarms, dashboards, tagging
Partnership with application engineers on Lambda, Aurora PostgreSQL, and Bedrock workloads
Lightweight threat modeling and security review of new features and third-party integrations touching PHI, including sponsor/CRO data-handling requirements
Benefits
We are a remote-based, fast growth team
All full-time employees receive paid vacation and parental leave
We provide a competitive salary & equity compensation
We offer technology tools and a work-from-home setup stipend
We offer medical, dental, and vision coverage to our employees
We value career development for all
Preferred experience
Hands-on AFT and Control Tower experience - you have vended accounts through AFT and customized the pipeline, not adjacent familiarity
GitHub Actions as a daily environment, including pipeline hardening and secrets management
Deep Terraform proficiency: module hierarchies, multi-environment state, drift and refactors, critical plan review
Hands-on, autonomous, and clear: you write code daily, take ambiguous problems to documented decisions, and can explain security tradeoffs to non-security people
Change and release discipline: you think about blast radius before you apply, have owned deployment and rollback strategies in production, and move quickly inside regulated-environment constraints rather than treating them as obstacles
SOC 2 Type II and HIPAA experience in a real PHI-handling environment - you have owned controls, produced evidence, and sat in front of an auditor
You use AI coding and automation tools as a daily part of how you work, and you actively explore how they change infrastructure and security practices
5+ years in DevSecOps, security, platform, or infrastructure engineering, operating production systems you were accountable for
Demonstrated security ownership: you have run vulnerability management, remediated real findings, and participated in incident response - not just deployed tooling
Genuine interest in improving clinical trial access and health equity
Compliance automation platforms (Drata, Vanta) including evidence automation
Aurora PostgreSQL operations and schema migration coordination
Python or TypeScript for automation
HITRUST, NIST 800-53, or CSA STAR exposure
Securing LLM workloads
Recruitment process
Our interview process typically includes four stages, followed by reference checks and an offer. Depending on the role, particularly for technical or senior positions, the process may vary slightly and can include a technical assessment, case study, presentation, practical exercise, additional interview conversations, or conversations with members of our leadership team and investors
