> Markdown version of [/jobs/ext/3847427-lead-security-engineer-us-remote](https://www.wearedevelopers.com/jobs/ext/3847427-lead-security-engineer-us-remote). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Security Engineer (US-Remote) - **Company:** Brain Trust, LLC - **Location:** New York, NY, United States (Remote available) - **Experience:** Expert - **Salary:** $185,000.0 - $215,000.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Amazon S3, Data Integration, Identity and Access Management, Key Management, Network Connections, Data Logging, Pulumi, Google Drive, Large Language Models, Data Lakes, Casper Suite, Machine Learning Operations, Software Coding, Terraform, Api Management - **Published:** October 20, 2026 - **Apply:** https://www.careerbuilder.com/job-details/lead-security-engineer-us-remote-new-york-ny--8c96bd6d-7a2c-45ad-97dd-aa12e445ea1a ## About the Role Network Connectivity, Cost Estimates, Artificial Intelligence (AI), Hospital/Healthcare Construction, Product Costing, Risk, HIPAA (Health Insurance Portability and Accountability Act), Business Operations, Security Compliance, Threat Modeling, * 6+ years in software or infrastructure engineering, with 2+ years focused on security and experience owning a security or compliance program end-to-end. * Deep SOC 2 experience: You've personally owned and managed SOC 2 audits end-to-end, ideally Type II, as the accountable owner rather than a contributor. * Hands-on knowledge of AWS security (IAM Identity Center, S3 policies, CloudTrail, GuardDuty). You can read a policy document and a Terraform/Pulumi diff and know what's wrong with both. * Ability to build tooling and automation yourself. You're comfortable writing code and scripting against APIs to eliminate manual compliance toil. * Practical, hands-on experience using AI tools in engineering or security workflows. You're actively experimenting with and applying AI to improve how work gets done, and can think critically about AI/LLM security risks, including prompt injection, data exfiltration, model safety, and supply-chain risks. * Track record of building security programs at startups or growth-stage companies, not just maintaining them at large enterprises. * Strong written communication. Much of this role is producing clear, defensible documentation for auditors and customers. Nice to Have * Experience with HIPAA compliance and securing systems that handle PHI. * Experience with PHI de-identification and handling in ML/AI pipelines. * Familiarity with healthcare payer or TPA ecosystems. * Background in securing API products and B2B data integrations. ## Description We're hiring our first full-time Lead Security Engineer to take full ownership of our security and compliance program. We're SOC 2 certified and HIPAA compliant, with security and compliance currently shared across engineering and ops. As we scale, these functions need a dedicated owner who can mature the program, deepen our operational practices, and let us keep moving fast without accumulating risk. This is an engineering-first, hands-on role, not a managerial or advisory one. It splits roughly evenly between compliance and GRC on one side and technical security engineering on the other. You'll own outcomes, not just recommendations, and you'll spend real time in the weeds: reviewing IAM policies, threat modeling PHI-bearing services, and building the tooling and knowledge base that keep the program running without constant manual effort. What You'll Do * Own the end-to-end security and compliance posture, including HIPAA, SOC 2, and vendor risk management, as the accountable party for audit cycles from scoping through evidence and auditor management. * Build and maintain a living, AI-enabled compliance knowledge base so evidence and control mappings are queryable and current, not reconstructed under audit pressure. * Own the BAA lifecycle with customers and vendors. * Conduct regular security assessments of our infrastructure (AWS, S3 data lake, AI integrations) and build a prioritized remediation roadmap. * Threat model our PHI-bearing services and drive remediation, with hands-on review of IAM, network boundaries, S3 access patterns, encryption, and logging. * Establish and maintain security policies, incident response procedures, and access control frameworks. * Own security tooling and automation, including detection, alerting, and evidence-collection pipelines you build yourself, leveraging AI to streamline manual processes where appropriate. * Evaluate and manage risk across our evolving AI toolchain, including enterprise LLM platforms, MCP integrations, and third-party connectors (Slack, Gmail, Google Drive). * Own DLP strategy for our data lake, including PHI quarantine architecture and access controls. * Manage our JAMF instance and endpoint security across the organization. * Partner with engineering on secure SDLC: branch protection, risk gating, dependency and secrets management. * Lead security reviews for new product features and AI capabilities before they ship. * Interface with customers and partners on security questionnaires, audits, and compliance requirements. * Build the security culture: training, awareness, and lightweight processes that engineers actually follow.