Principal Security Engineer (Healthcare)

Location: United States (Remote)

Base salary: $195,000–$225,000 annually, plus annual bonus incentive, company benefits, and potential employee equity purchase program eligibility.

Company

hirify.global is a technology-enabled, pediatrician-led medical group providing 24/7 virtual-first and in-home medical, behavioral, and social care for children with complex healthcare needs.

What you will do

• Set the technical vision for endpoint, email, data loss prevention, vulnerability management, penetration testing, network, application, and data security.
• Define cloud and identity security strategy across AWS and Microsoft Azure/EntraID, including privileged access, phishing-resistant MFA, governance of AI agents, service accounts, and API keys.
• Lead security architecture reviews and threat modeling for Care Hub, Medplum services, FHIR access policies, SMART scopes, Bots, custom code, and Snowflake data platforms.
• Define DevSecOps strategy and security gates across the SDLC and CI/CD pipeline using GitHub Advanced Security, OWASP Top 10 practices, software bills of materials, and CISA Known Exploited Vulnerabilities prioritization.
• Act as the senior technical escalation point, including on-call participation, for serious security events; strengthen incident playbooks, ransomware and critical-SaaS exercises, and restoration testing.
• Shape the security roadmap, compliance evidence pipelines, automated configuration controls, AI adoption, engineering planning, stakeholder collaboration, and security engineering mentorship.

Requirements

• 10+ years of experience as a Security Engineer, Principal Security Engineer, Security Architect, or similar, including at least 5 years in healthcare.
• Bachelor of Science degree in Computer Science, Information Security, Business, Management, or a related field is desired.
• Relevant certifications such as CISSP, CCSP, CISM, GIAC, AWS Certified Security – Specialty, or Microsoft Certified: Cybersecurity Architect Expert are preferred.
• Experience setting security technical strategy and aligning security, IT, and engineering teams.
• Deep expertise in AWS and Microsoft Azure/EntraID cloud and identity security architecture.
• Hands-on application and product security experience, including threat modeling, secure SDLC, CI/CD design, and healthcare APIs such as FHIR and SMART on FHIR.
• Experience leading detection and response programs, working with MDR providers, and responding technically to serious incidents and data breaches.
• Extensive experience translating HITRUST and HIPAA Security Rule requirements into technical controls and supporting auditors, payors, and regulators.
• Experience using AI to enhance and automate security processes and understanding of AI system security risks.
• Knowledge of AWS, Microsoft Intune, EntraID, CrowdStrike Falcon, GitHub Advanced Security, Snowflake, JAMF, Meraki, and JIRA Service Management.
• Strong collaboration and coaching skills, including developing senior engineers; autonomy in ambiguous environments; and experience in a fast-paced, hypergrowth, collaborative environment.
• Willingness to participate in an on-call rotation.

Nice to have

• Advanced degree.
• Experience with Medplum.
• Contributions to the security community through conference talks, publications, or industry threat intelligence sharing.

Culture & Benefits

• Remote role serving a pediatric healthcare mission focused on children with complex medical conditions.
• Medical, dental, and vision insurance; healthcare and dependent-care FSA; and company-funded HSA.
• 401(k) with a 4% match, fully vested from day one.
• Employer-paid short- and long-term disability, life insurance at 1x annual salary, and paid new-parent leave.
• 20 days of paid time off, 10 company holidays, and 2 floating holidays.
• Values emphasize children first, trust, innovation, empathy, and diverse perspectives.