We are seeking a Lead Security Engineer to own HIPAA and FedRAMP/NIST 800-53 compliance delivery and translate requirements into actionable engineering plans. You will guide audit readiness by managing evidence requests and aligning with ISRM, Privacy, Legal, SRE, and cloud platform teams. Apply to help streamline compliance work and support successful third-party audits

Responsibilities

- Convert HIPAA gap analysis outputs, NIST 800-53 privacy controls, and audit findings into well-scoped Azure DevOps Features/Stories/Tasks with acceptance criteria, estimates, and accountable owners

- Organize and prioritize the compliance backlog spanning access control, data classification, log scrubbing, audit logging, data retention & deletion, and data access restrictions

- Create and run control validation test cases (including privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request) and capture pass/fail documentation

- Oversee the workflow for third-party auditor evidence requests from intake through completion, including Schellman FedRAMP Significant Change Reviews

- Associate every audit request with its NIST 800-53 control and coordinate with engineering, ISRM, Privacy, and Legal to gather artifacts within auditor timelines

- Compile and share ongoing compliance progress reports with stakeholders

- Implement simple automation such as scripts, dashboards, and evidence pipelines to reduce repetitive audit work as programs expand to additional clients and jurisdictions

- Partner with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document inherited AWS/Azure controls versus internally developed or maintained controls

Requirements





- Substantial overall IT experience with at least 5 years in professional roles

- Demonstrated experience in compliance engineering, GRC, or security/privacy compliance, including work on HIPAA and/or FedRAMP/NIST 800-53 programs

- Solid knowledge of HIPAA Security & Privacy Rules (administrative/physical/technical safeguards, BAAs, breach notification, minimum necessary) and NIST 800-53 control families including AC, AU, SI, and PM

- Ability to break down regulatory and compliance language into clear, estimable engineering backlog work using Azure DevOps, Jira, or similar platforms

- Practical experience supporting audits such as SOC 2, FedRAMP, or HITRUST by collecting evidence, mapping controls to artifacts, and responding on schedule

- Familiarity with AWS GovCloud and/or Azure Government plus key controls such as IAM/RBAC, encryption/KMS, audit logging, and data retention & deletion

Nice to have

- Experience handling FedRAMP Significant Change Requests (SCR) and working with assessors

- Automation and scripting skills in Python or Bash for evidence collection, control testing, or compliance dashboards

- Hands-on work with SailPoint (or similar) and AWS IAM access policy management across S3, RDS, DynamoDB, and Redshift

- Knowledge of UK/EU GDPR, Australia Privacy Act, or Canada PIPEDA, or ability to learn quickly as scope broadens

- Certifications such as CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certification

- Exposure to remediation tracking tools like Snyk, Wiz, Qualys, or Burp and programs for secrets/certificate rotation

- Experience supporting legal-tech, healthcare, or government SaaS products that process regulated data

📌 Lead Security Engineer, HIPPA Compliance (Coimbatore)
🏢 EPAM Systems
📍 Coimbatore