Security engineer in healthcare

500M+ downloads. 80M+ monthly users. A decade of building – and we’re still accelerating. Flo is the world’s #1 health & fitness app worldwide on a mission to build a better future for female health. Backed by a $200M investment led by General Atlantic, we became the first product of our kind to reach a $1B valuation in 2024 – and we’re not slowing down.

• Lead annual SOC 2 and HIPAA certifications, managing interfaces with external auditors and professional services.
• Partner with Engineering to harden AWS workloads (EKS, EC2, data pipelines, and more) to meet HIPAA and SOC 2 controls; perform technical security design reviews and architectural risk assessments for services handling PHI.
• Define and maintain security policies and standards; embed risk assessment activities within engineering processes, and evolve Flo's security risk management framework.
• Support vendor risk activities including contract reviews and security posture assessments.
• Partner with control owners to automate evidence gathering and ensure controls reduce friction rather than creating it.
• Serve as the primary Security POC for US regulators and partners; support the wider Security team with ISO 27001/27701 alignment; report risk status to security leadership.
• Manage and integrate GRC and compliance automation platforms to streamline monitoring and reporting.

• 7+ years in security, compliance, or risk management (3+ in a leadership capacity), with a Bachelor's degree in a related field or equivalent experience.
• Deep expertise in SOC 2 within the AWS environment.
• Familiarity with PHI handling, GRC and compliance automation platforms, and exposure to enterprise architecture frameworks such as TOGAF.
• Strong ability to manage multiple concurrent audit and certification workstreams.
• Excellent written and verbal communication, with the ability to translate complex compliance requirements into clear actions for engineering and business teams.
• Будет плюсом: Familiarity with HIPAA frameworks would be considered a big plus; CISA, CISM, or CISSP certifications; Experience with NIST 800-53, Cloud Security Alliance (CSA), and Center for Internet Security (CIS) frameworks; Experience in healthcare or another regulated industry; HITRUST experience a plus; Experience building compliance roadmaps in early-stage startups; Exposure to containerization (Docker/Kubernetes), serverless, and big data platforms; Exposure to DevSecOps and sprint-based Agile development; Vendor management experience

• Competitive salary and annual reviews
• Opportunity to participate in Flo’s performance incentive scheme
• Paid holiday, sick leave, and female health leave
• Enhanced parental leave and pay for maternity, paternity, same-sex and adoptive parents
• Accelerated professional growth through world-changing work and learning support
• In-person collaboration and work in a hybrid model, with 3 days per week spent in the office
• 5-week fully paid sabbatical at 5-year Floversary
• Flo Premium for friends & family, plus more health, pension and wellbeing perks