Principal Security Engineer

Description

The company is a tech-enabled medical group led by pediatricians, focused on children with special health care needs.

It provides 24/7 virtual-first and in-home medical, behavioral and social care, working with families, providers and health plans. It adds support to existing care teams rather than replacing them.

Responsibilities

• Set the technical direction for protecting systems, data and the children and families who rely on the company, and act as a trusted senior security adviser to the VP, Information Security.
• Make secure defaults the norm in how the company builds and runs technology, working with Engineering on DevSecOps strategy and architecture improvements.
• Stay hands-on with the hardest problems while raising the capability of the security team and the engineers around you.
• Own the technical vision for the security stack: endpoint, email, data loss prevention, vulnerability management and penetration testing, network, application and data security, aligned with business and clinical strategy.
• Define long-term cloud and identity security strategy across Microsoft Azure/EntraID and AWS, covering privileged access, phishing-resistant MFA and governance of non-human identities such as AI agents, service accounts and API keys.
• Lead security architecture reviews and threat modeling for the company's care platform and connected services, including Medplum application-layer controls (FHIR access policies, SMART scopes, Bots and custom code) and data platforms such as Snowflake.
• Define DevSecOps strategy and set standard security gates across the SDLC and CI/CD pipeline, building on GitHub Advanced Security, OWASP Top 10 practices, software bills of materials and prioritizing CISA Known Exploited Vulnerabilities.
• Serve as the senior technical escalation point, including on the on-call rotation, for the most complex and highest-stakes security events. Strengthen incident playbooks, ransomware and critical-SaaS exercises, and restoration testing against recovery targets.
• Track the healthcare threat landscape, including AI-enabled and agentic attacks, and advise on what it means for business strategy.
• Build documentation and evidence pipelines, including AI-assisted ones, so the company can show its security posture to payors, regulators, auditors and other third parties against HITRUST, HIPAA and NIST requirements.
• Turn ambiguous, high-stakes security questions into well-reasoned answers, delivering decision-ready recommendations, risk rankings and documented resolution paths.
• Build guardrails such as automated configuration checks and drift detection so misconfigurations are prevented across the board, not caught one at a time.
• Shape the technical sequencing of the multi-year security roadmap, contribute to quarterly engineering planning, and keep security execution aligned with company strategy and business deadlines.
• Explore early-stage ideas and proofs of concept to reduce risk before security initiatives are staffed or scoped.
• Promote thoughtful AI use within security to cut manual work, and guide the secure adoption of AI tools and AI-enabled products across the company.
• Work with engineering, product, IT and clinical stakeholders to build security into how products are designed, built and operated, explaining complex concepts to non-technical audiences.
• Mentor the security engineering team, coach engineers across technology on security craft, and shape the team's learning culture.
• Advise leadership and advocate for security engineers, aligning security decisions with business priorities and staying composed in high-stakes, ambiguous situations.
• Use professional discretion when handling sensitive and personal data.
• Other duties as assigned.

Requirements

• 10+ years as a Security Engineer, Principal Security Engineer, Security Architect or similar role, with at least 5 years in the healthcare industry.
• A record of setting security technical strategy and aligning security, IT and engineering teams.
• Deep cloud and identity security architecture experience across AWS and Microsoft Azure/EntraID.
• Hands-on application and product security work, including threat modeling, secure SDLC and CI/CD design, and securing healthcare APIs (FHIR, SMART on FHIR).
• Experience leading detection and response, including working with MDR providers and leading the technical response to serious security incidents and data breaches.
• Extensive experience turning HITRUST and HIPAA Security Rule requirements into technical controls, and supporting auditors, payors and regulators.
• Experience using AI to improve and automate security processes, and an understanding of the security risks AI systems introduce.
• Working knowledge of AWS, Microsoft Intune, EntraID, CrowdStrike Falcon (EDR/SIEM), GitHub Advanced Security, Snowflake, JAMF, Meraki and JIRA Service Management.
• Strong collaboration and coaching skills, with a record of developing senior engineers.
• Comfort working autonomously in ambiguity, exploring early-stage ideas without well-defined requirements.
• Experience in a fast-paced, hypergrowth, collaborative environment.
• Willingness to join an on-call rotation.
• Commitment to improving care for children with complex medical conditions.
• A Bachelor of Science in Computer Science, Information Security, Business, Management or a related field is desired; an advanced degree is a plus.
• Relevant certifications are preferred: CISSP, CCSP, CISM, GIAC (e.g., GCIH, GCLD, GSEC), AWS Certified Security Specialty, Microsoft Certified: Cybersecurity Architect Expert.
• Medplum experience is a plus.
• Contributions to the security community, such as conference talks, publications or industry threat intelligence sharing, are a plus.

Conditions

Pay is set using job-related knowledge, skills and experience, so the final compensation may vary.

The company values diversity, equity, inclusion and belonging.

Benefits

• Base salary range of $195,000-$225,000, plus an annual bonus incentive.
• Competitive company benefits package.
• Eligibility to join an employee equity purchase program, as applicable.
• Competitive medical, dental and vision insurance.
• Healthcare and Dependent Care FSA, plus a company-funded HSA.
• 401(k) with a 4% match, 100% vested from day one.
• Employer-paid short-term and long-term disability.
• Life insurance at 1x annual salary.
• 20 days PTO, 10 Company Holidays and 2 Floating Holidays.
• Paid new parent leave.
• Further benefits detailed in the offer.