[Hiring] Senior Engineer / Tech Lead, Trust (Security, Privacy & Compliance) @Atomic HR

Role Description

This is not a "review and advise" security role. You build the controls yourself.

• State and federal buyers are asking for stricter security standards.
• Security and privacy are now core parts of the platform, not side projects.
• You'll be the senior engineer and tech lead for the platform's security, privacy, and compliance controls.
• You'll be the technical partner to the Trust Product Manager.
• Start with the engineering behind the existing SOC 2 Type II and HIPAA controls.
• Lead the technical side of the company's NIST 800-series alignment.

What you'll do

• Identity & Production Access (primary focus)
  • Design how people and services sign in, what each role is allowed to do, and where secrets are stored.
  • Decide how engineers get into production and who approves that access.
  • Write the design and the code, and agree on the requirements with the Trust PM.
• Isolation & Audit Logging
  • Keep environments, tenants, workloads, and sensitive data separate from each other.
  • Build audit logs and change history that show who did what, in a form outside auditors can test.
• SOC 2 Type II & HIPAA Controls
  • Keep the technical controls working, and move access reviews and evidence pulls from manual steps into code.
  • Take every technical audit finding through to closure, and work with auditors on their tests.
• Secure Delivery
  • Build the release path in CI/CD and infrastructure as code, with approvals before anything reaches production.
  • Publish shared modules and reference implementations so other teams get the controls by default.
• Threat Modeling & Review
  • Run threat models on critical workflows and turn each finding into an engineering requirement.
  • Review security-sensitive code, infrastructure, and architecture changes before they go live.
• Incident Readiness
  • Own logging, detection, runbooks, and escalation paths on the engineering side.
  • Lead or support investigation and containment when an incident happens, and join tabletop exercises with the PM and leadership.
• NIST 800-series Path
  • With the PM, translate NIST requirements into controls and priorities.
  • Give leadership a technical roadmap for state and federal environments, moving toward FedRAMP-aligned practices where they apply.

Qualifications

• 7+ years of software engineering, including a few years as the senior or lead engineer on production systems.
• Hands-on SOC 2 Type II and HIPAA experience.
• Cloud-native production experience, ideally on AWS.
• Identity and access systems you designed.
• Threat modeling carried through to shipped controls.
• Good judgment on what to enforce in software and what to leave as a process.
• Comfort working autonomously while the architecture and operating model are still taking shape.
• You must be based in the U.S.

Requirements

• NIST 800-53 or other 800-series controls you mapped to real system changes.
• FedRAMP or ISO 27001 experience.
• Automated evidence collection or continuous control monitoring that an auditor accepted.
• Incident-response runbooks you wrote, or a tabletop exercise you ran.
• Node, TypeScript, and AWS in the same production environment.
• Software built for government, healthcare, or fintech customers.

Benefits

• A fully remote role within the U.S.
• $14,583–$17,500 USD/month, depending on experience.
• Full-time employment through an Employer of Record (EOR).
• Real technical ownership: the design decisions, and the order in which controls get built, are yours.
• Direct collaboration with Product & Engineering leadership in a small, fast-growing team.
• Mission-driven impact: your work protects the data of families who rely on public benefits.

Interview Process

• Application review (resume and a few questions).
• 30-minute screening call with Atomic HR about what you've built and what you want next.
• Profile shared with the hiring manager, who decides whom to meet.
• Interviews with the hiring manager covering your access, audit logging and isolation designs, how you run threat models, and how you decide which controls to build now.
• Offer.