HIPAA Security Engineer

About the role

As a key member of Flo’s Security Architecture team, you will lead the design and operation of US Healthcare security controls, translating HIPAA and SOC 2 requirements into technical controls across our AWS environment. You will work closely with product, engineering, legal and external auditors to ensure a secure, compliant platform for millions of users.

Key responsibilities

• Lead annual SOC 2 and HIPAA certifications, managing interfaces with external auditors and professional services.
• Partner with Engineering to harden AWS workloads (EKS, EC2, data pipelines, etc.) to meet HIPAA and SOC 2 controls.
• Define and maintain security policies and standards, embedding risk assessment activities within engineering processes.
• Support vendor risk activities, including contract reviews and security posture assessments.
• Manage and integrate GRC and compliance automation platforms to streamline monitoring and reporting.

Required profile

• 7+ years in security, compliance, or risk management, including 3+ years in a leadership role.
• Bachelor’s degree in a related field or equivalent experience.
• Deep expertise in SOC 2 and HIPAA frameworks within AWS.
• Experience with PHI handling, GRC and compliance automation platforms.
• Strong ability to manage multiple concurrent audit and certification workstreams.

Required skills

• AWS services (EKS, Lambda, RDS, S3, VPC, IAM, KMS).
• Security frameworks: SOC 2, HIPAA, TOGAF.
• Compliance automation and GRC tools.
• Containerization (Docker, Kubernetes) and serverless architectures.
• DevSecOps practices.

What we offer

• Competitive salary £100,000–£130,000 per year.
• Performance incentive scheme.
• Paid holiday, sick leave, female health leave, and enhanced parental leave.
• 5‑week fully paid sabbatical after 5 years.
• Hybrid work model – three days per week in the office.
• Flo Premium for friends & family plus additional health, pension and wellbeing perks.