Location:Hybrid 3 days (offices in NYC, Denver, CO and Charlotte, NC area)

Position Summary

Reporting to the Director of Security Engineering, this Security Engineer role is a hands-on role responsible for securing Judi Health’s cloud environments and the applications that run in them. This role sits at the intersection of cloud security and application security: hardening cloud infrastructure and infrastructure as code, building automation that enforces and evidences security controls, and partnering with software engineering teams to identify and remediate application-layer risk. 

Judi Health operates a FedRAMP Moderate platform in addition to SOC 1, SOC 2, HITRUST, and HIPAA obligations. The engineer in this role will work inside that authorization boundary every day — maintaining continuous monitoring, contributing to continuous control validation and automated compliance evidence, and supporting change management and external assessments. This is a strong fit for an engineer who wants to build durable security capability in a regulated, cloud-native environment rather than operate tools in isolation. 

Position Responsibilities:

• Design, implement, and improve security controls across our cloud infrastructure, platform services, and supporting integrations, including identity and access management, network segmentation, logging, encryption, and key and secrets management.
• Harden infrastructure as code and cloud deployment pipelines, reviewing Terraform and CI/CD changes for security impact and building preventative guardrails rather than after-the-fact findings. 
• Operate and tune cloud security tooling — CSPM/CNAPP, SIEM, vulnerability management, and endpoint and data protection platforms — and drive consolidation toward a unified, well-instrumented approach. 
• Triage, prioritize, and drive remediation of cloud misconfigurations, vulnerabilities, and posture findings, working directly with platform, infrastructure, and engineering owners through to closure. 
• Contribute to detection engineering and incident response, including alert development and tuning, investigation, threat hunting, containment support, and documentation of findings and root cause. 
• Review application and service designs for authentication, authorization, input validation, data exposure, and secrets-handling risk, and participate in architecture and design reviews for new Judi capabilities. 
• Assess code changes for security impact with enough fluency in Python and modern JavaScript frameworks to recognize unsafe patterns and propose practical fixes. 
• Embed security into the software development lifecycle through dependency scanning, secrets detection, container image scanning, and enforcement of pipeline security gates. 
• Contribute to secure coding guidance, developer-facing documentation, and practical enablement that helps engineering teams ship securely by default. 
• Execute continuous monitoring activities including recurring infrastructure, database, web application, and container scanning, and maintain accurate, timely remediation tracking and POA&M entries. 
• Build automation for security monitoring, evidence collection, control validation, and policy enforcement to support continuous compliance at scale. 
• Author security impact analyses for changes affecting the authorization boundary, including affected components, impacted controls, risk, mitigations, and validation approach, and support the change control process. 
• Translate FedRAMP, SOC 1, SOC 2, and HITRUST control requirements into practical, auditable technical implementations in partnership with the IT Audit and Compliance team. 

Required Qualifications:

• Three or more years of hands-on experience in security engineering, cloud security, application security, or a closely related discipline. 
• Demonstrated experience securing production AWS environments, including identity and access management, network controls, logging and monitoring, encryption, and cloud-native security services. 
• Working proficiency in at least one modern programming or scripting language, with a track record of automating security tasks rather than performing them manually. 
• Practical experience with infrastructure as code, including reading and writing Terraform and assessing infrastructure changes for security impact. 
• Experience with application security concepts and tooling, including the OWASP Top 10, API security risks, and SAST, DAST, or software composition analysis platforms. 
• Experience with security operations disciplines such as SIEM, vulnerability management, detection and alerting, and incident investigation. 
• Solid understanding of authentication and authorization patterns, least privilege, and secrets management, including OAuth2/OIDC and enterprise SSO. 
• Ability to work independently, prioritize effectively, and drive remediation across teams without formal authority. 
• Strong written communication skills, with the ability to produce documentation and evidence that withstands audit and assessor scrutiny. 

(Optional) Preferred Qualifications:

• Experience supporting a regulated or audited environment such as FedRAMP, FISMA, StateRAMP, or CMMC, including control implementation and evidence management. 
• Familiarity with NIST SP 800-53 Rev 5 control families and FedRAMP continuous monitoring expectations. 
• Experience with policy-as-code or automated compliance validation in cloud environments.
• Knowledge of container and orchestration security, including Kubernetes, ECS, or EKS. 
• Experience in healthcare, health tech, or another highly regulated industry handling sensitive data. 
• Industry certifications such as AWS Security Specialty, CCSP, CISSP, or similar. 
• Familiarity with AI and ML security concepts, including model access, data protection, and secure adoption practices.