[Hiring] Senior Security Engineer @EPAM

Role Description

We are looking for a Senior Security Engineer to join our team. We need an Engineer who can sit at the intersection of compliance/legal requirements and engineering delivery:

• Reading raw regulatory or audit requirements.
• Scoping them into concrete technical work.
• Tracking that work to closure.
• Running the evidence-collection process for external audits.

This program will expand over time to cover additional government and commercial-regulated clients, plus country-specific privacy regimes (UK, EU, Australia, Canada).

Responsibilities:

• Translate regulatory and audit requirements into actionable work items by converting HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps Features, Stories, and Tasks with clear acceptance criteria, effort estimates, and a named owner.
• Track delivery progress and maintain backlog hygiene across active compliance features, including:
  • Access control
  • Data classification
  • Log scrubbing
  • Audit logging
  • Data retention and deletion
  • Data access restrictions
• Write and execute test cases to verify that controls function as designed, documenting pass/fail evidence throughout.
• Own the end-to-end audit support process, including intake, tracking, and fulfillment of third-party auditor evidence requests.
• Produce recurring compliance status reporting for stakeholders and build lightweight automation to reduce manual effort in future audit cycles.
• Coordinate across teams, partnering with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document controls inherited from AWS/Azure.

Qualifications

• A minimum of 3 years of relevant experience in security/privacy compliance, GRC, or compliance engineering, supporting HIPAA and/or FedRAMP/NIST 800-53 programs.
• Solid working knowledge of the HIPAA Security & Privacy Rules, including administrative, physical, and technical safeguards, BAAs, breach notification, and minimum necessary standards.
• Demonstrated ability to translate compliance and regulatory language into scoped, estimable engineering backlog items using Azure DevOps, Jira, or similar tools.
• Direct experience supporting third-party audits, such as SOC 2, FedRAMP, or HITRUST, including evidence collection, control-to-evidence mapping, and meeting auditor deadlines.
• Familiarity with cloud environments, such as AWS GovCloud and/or Azure Government, and the controls relevant to compliance.
• Excellent English communication skills (B2 level or higher).

Requirements

• Direct experience with FedRAMP Significant Change Requests (SCR) and assessor engagements.
• Scripting and automation skills, such as Python or Bash, to automate evidence collection, control testing, or compliance dashboards.
• Experience with AWS IAM/identity governance tooling, such as SailPoint or equivalent.
• Exposure to international privacy regimes, such as UK/EU GDPR, Australia's Privacy Act, or Canada's PIPEDA.
• Relevant certifications, such as CIPP/US, CIPM, HCISPP, CISA, CISSP, or an AWS/Azure security certification.
• Experience with security-scan remediation tracking, using tools such as Snyk, Wiz, Qualys, or Burp.
• Background supporting legal-tech, healthcare, or government SaaS products that handle regulated data.