We are hiring a Senior Security Architect/ Engineer to build and own the HIPAA and SOC 2 compliance programs end to end. You will design the security architecture that protects patient and customer data, stand up continuous monitoring for data leakage, and harden our systems against intrusion and penetration attempts. This is a hands-on senior role: you will set things up from scratch where needed, not just maintain what exists.

You will report to CTO and work closely with engineering, DevOps, legal and leadership.

Key responsibilities

- Build and own the HIPAA and SOC 2 compliance programs end to end.
- You will design the security architecture that protects patient and customer data, stand up continuous monitoring for data leakage, and harden our systems against intrusion and penetration attempts.
- This is a hands-on senior role: you will set things up from scratch where needed, not just maintain what exists.
- Compliance program (HIPAA and SOC 2)
- Build and lead the HIPAA security program: risk assessments, Security Rule administrative, physical and technical safeguards, and Breach Notification Rule readiness.
- Drive SOC 2 Type I and Type II readiness across the Trust Services Criteria (Security, Availability, Confidentiality, and others as in scope).
- Write and maintain security policies, standards and procedures, and map controls across HIPAA, SOC 2 and related frameworks (NIST CSF, ISO 27001, HITRUST).
- Own audit preparation: evidence collection, control testing, gap remediation, and acting as the main contact for external auditors.
- Manage Business Associate Agreements (BAAs) and vendor security reviews for any third party that handles PHI.
- Implement a compliance automation platform (e.g. Vanta, Drata, Secureframe) for continuous control monitoring.
- Security architecture
- Design secure, zero-trust architecture across cloud (AWS, Azure or GCP), applications, networks and endpoints.




- Define identity and access management standards: SSO, MFA, least privilege, privileged access management and quarterly access reviews.
- Set encryption standards for PHI and sensitive data at rest and in transit, including key management.
- Review designs and embed security into the SDLC through threat modeling, secure code review, SAST, DAST and dependency scanning.
- Data leak prevention and monitoring
- Deploy and tune Data Loss Prevention (DLP) controls across email, endpoints, cloud storage and SaaS apps.
- Classify data and maintain an inventory of where PHI and confidential data lives and flows.
- Stand up centralized logging, SIEM and alerting (e.g. Splunk, Microsoft Sentinel, Datadog, Elastic) with detection rules for exfiltration and anomalous access.
- Monitor cloud security posture (CSPM) and fix misconfigurations such as public buckets and over-permissive roles.
- Hands on Experience in Azure Purview and Sentinel
- Penetration and intrusion prevention
- Run the vulnerability management program: scanning, prioritization, patch SLAs and tracking to closure.
- Plan and oversee annual third-party penetration tests and internal red-team exercises; own remediation.
- Configure and manage WAF, IDS/IPS, EDR/XDR, network segmentation and firewall rules.
- Harden infrastructure and container baselines against CIS Benchmarks
- Incident response
- Build and test the incident response plan, including tabletop exercises at least twice a year.




- Lead investigation and containment of security incidents and data breaches.
- Coordinate HIPAA breach notification with legal within required timelines.
- Leadership and culture

Qualifications

- 10+ years in information security, with 5+ years in a security architect or senior security engineering role.
- Proven track record of taking at least one organization through a successful SOC 2 Type II audit.
- Hands-on experience implementing HIPAA Security Rule controls in a healthcare, health-tech or PHI-handling environment.
- Deep knowledge of at least one major cloud platform (AWS, Azure or GCP) and its native security services.
- Proficient in Microsoft Purview (data classification, sensitivity labels, DLP policies, compliance management) and Microsoft Sentinel (SIEM/SOAR, KQL detection rules, threat hunting, automated playbooks).
- Practical experience deploying DLP, SIEM, EDR and vulnerability management tools.
- Robust grasp of network security, IAM, encryption, and application security (OWASP Top 10).
- Experience leading incident response for real security events.
- Ability to explain risk clearly to non-technical leaders and write audit-ready documentation.
- Bachelor’s degree in Computer Science, Information Security or a related field, or equivalent experience.

Pay range and compensation package

- Compensation will be offered in line with current market standards and will be commensurate with the candidate's qualifications, skills, and relevant experience.

Equal Opportunity Statement

Aptimized is an Equal Opportunity Employer committed to fostering a diverse, equitable, and inclusive workplace. We make all employment decisions based on merit, qualifications, skills, experience, and business needs, without discrimination based on race, religion, gender, age, disability, sexual orientation, or any other characteristic protected by applicable law.

📌 Senior Security Architect/Engineer (HIPAA & SOC 2) (Hyderabad)
🏢 Aptimized
📍 Hyderabad