We are hiring a Lead Security Engineer to drive HIPAA and FedRAMP/NIST 800-53 compliance by turning regulatory mandates into engineering work. You will partner with Security, Privacy, and Legal to prepare for and support third-party audits, including SOC 2 and FedRAMP efforts. Apply to help keep compliance execution predictable and audit-ready

Responsibilities

- Translate HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into Azure DevOps Features/Stories/Tasks with clear acceptance criteria, estimates, and an assigned owner

- Maintain an organized backlog across compliance initiatives such as access control, data classification, log scrubbing, audit logging, data retention & deletion, and data access restrictions

- Design and execute test cases to validate controls (for example privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request) and record pass/fail outcomes

- Coordinate intake, tracking, and closure of auditor evidence requests, including items like Schellman FedRAMP Significant Change Reviews

- Map each audit request to the relevant NIST 800-53 control and partner with engineering, ISRM, Privacy, and Legal to collect artifacts and hit auditor timelines

- Produce recurring compliance status updates for internal stakeholders

- Build lightweight automation such as scripts, dashboards, and evidence pipelines to reduce manual work as audits expand to recent clients and jurisdictions

- Collaborate with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document which controls are inherited from AWS/Azure versus maintained or built internally

Requirements

- Extensive IT experience with 5+ years in professional roles





- Solid background in security/privacy compliance, GRC, or compliance engineering, supporting HIPAA and/or FedRAMP/NIST 800-53 programs

- Deep understanding of HIPAA Security & Privacy Rules, including administrative/physical/technical safeguards, BAAs, breach notification, and minimum necessary standards, plus NIST 800-53 families such as AC, AU, SI, and PM

- Proven track record translating compliance and regulatory language into scoped, estimable backlog items in Azure DevOps, Jira, or similar tools

- Hands-on experience supporting third-party audits such as SOC 2, FedRAMP, or HITRUST, including evidence gathering, control-to-evidence mapping, and meeting auditor deadlines

- Working knowledge of cloud environments like AWS GovCloud and/or Azure Government, including IAM/RBAC, encryption/KMS, audit logging, and data retention & deletion controls

Nice to have

- Direct experience with FedRAMP Significant Change Requests (SCR) and assessor interactions

- Python or Bash scripting to automate evidence collection, control testing, or compliance dashboards

- Experience with AWS IAM/identity governance tools such as SailPoint (or equivalent) and managing access policies across S3, RDS, DynamoDB, and Redshift

- Familiarity with international privacy regimes such as UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, or ability to ramp up quickly as coverage expands

- Relevant certifications such as CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certification

- Experience tracking security-scan remediation with tools like Snyk, Wiz, Qualys, or Burp, plus secrets/certificate rotation programs

- Background supporting legal-tech, healthcare, or government SaaS products handling regulated data

📌 Lead Security Engineer - HIPPA (Gurugram)
🏢 EPAM Systems
📍 Gurugram