HIPAA Security Engineer (London)

About the role

Flo Health is seeking a HIPAA Security Engineer to lead the design and operation of US healthcare security controls in its AWS environment. The role is based in London and requires relocation from the US, with full visa sponsorship and relocation support.

Key responsibilities

• Lead annual SOC 2 and HIPAA certifications, coordinating with external auditors and professional services.
• Design and implement technical security controls across AWS services (EKS, Lambda, RDS, S3, VPC, IAM, KMS) to meet compliance requirements.
• Define and maintain security policies, embed risk assessments into engineering processes, and evolve the security risk management framework.
• Manage vendor risk activities, including contract reviews and security posture assessments.
• Automate evidence gathering and integrate GRC/compliance automation platforms.

Required profile

• 7+ years of experience in security, compliance, or risk management, with at least 3 years in a leadership capacity.
• Deep expertise in SOC 2 and HIPAA frameworks within AWS environments.
• Experience handling PHI, GRC platforms, and familiarity with enterprise architecture frameworks such as TOGAF.
• Strong communication skills to translate complex compliance requirements into actionable engineering tasks.

Required skills

• AWS (EKS, Lambda, RDS, S3, VPC, IAM, KMS)
• SOC 2 and HIPAA compliance implementation
• GRC and compliance automation platforms
• Enterprise architecture frameworks (TOGAF)
• Containerization (Docker, Kubernetes) and serverless architectures
• DevSecOps practices and Agile development

What we offer

• Competitive salary with annual reviews and performance incentive scheme.
• Paid holiday, sick leave, female health leave, and enhanced parental leave.
• Hybrid work model – three days per week in the London office.
• 5‑week fully paid sabbatical after five years of service.
• Access to Flo Premium for friends & family and additional health, pension, and wellbeing perks.