Example Company
Software engineer
- Location
- San Francisco
- Type
- Full time
- Compensation
- $150k-$200k
- Posted
- 2 days ago
Join a team building useful software. Work closely with engineering and design to turn new ideas into products.
Loading job details
Security Engineer
- Posted
- 12D AGO
About the role
The Role
Aradigm is a public benefit corporation helping people with cancer and other serious diseases access life-changing cell and gene therapies that can potentially cure them. We do this through a new coverage model for self-insured employers and health plans, and our customers trust us with their members' sensitive health data.
We're hiring our first Security Engineer, one of the first engineering hires after our Head of Engineering, to own security and compliance across the company. You'll own our HITRUST r2 and SOC 2 Type 2 programs and be the person customers and partners talk to when they want to know how we protect their data. This is a hands-on role: you'll write the policy, implement the control, collect the evidence, and answer the questionnaire.
You'll report to our Head of Engineering and work closely with our engineering and data teams, legal counsel, and an external IT partner. There's no security department to inherit, and we're a flat organization with no levels: you grow here by taking on more scope and owning outcomes. We work remotely within the US, with a strong preference for the East Coast and travel to our NYC office 3–5 times a year.
What Success Looks Like
Success in this role means obtaining and maintaining our HITRUST r2 and SOC 2 Type 2 certifications.
You won't do it alone. Your first six months focus on honing our processes and procedures, with our assessor, an external penetration testing team, and other security vendors helping you move faster.
What You'll Do
Own HITRUST and SOC 2: lead our HITRUST r2 and SOC 2 Type 2 programs, including expanding HITRUST scope over time, and run the evidence, control testing, and remediation that keep both current year-round
Own customer security reviews: answer security questionnaires, diligence requests, and audit asks from employers, health plans, and carriers; turn repeat questions into reusable, accurate answers
Guide secure engineering: review security designs for new systems, audit our existing cloud (GCP) implementation, and give engineers clear, practical feedback rather than gatekeeping
Run data loss prevention and AI governance: operate our DLP tooling and the controls around how AI tools and agents access sensitive data
Manage vendor and third-party risk: assess vendors and subprocessors, and work with legal to confirm BAA terms match how data actually flows
Partner with IT: work with our external IT team to make sure endpoint management, EDR, and other security tooling are deployed and configured correctly
Build the program: write and maintain policies, run security awareness training, own incident response planning, and keep the risk register honest
Who You Are
4–10 years of hands-on security and compliance experience, ideally in healthcare; experience in another highly regulated industry (financial services, insurance, government) also works
You've taken an organization through HITRUST (r2 strongly preferred) or a comparable framework, and you've owned SOC 2 evidence and audits directly
Working knowledge of HIPAA Security and Privacy Rules and what a BAA does and doesn't cover
Comfortable in a cloud environment: you can read an IAM policy, review logging and network config, and spot a risky design
Clear writer who can explain controls to an auditor, a customer's security team, and an engineer, each in their own terms
A builder, not a box-checker: you prefer controls that work in practice over ones that only pass an audit
Comfortable in ambiguous, fast-moving environments where you set the priorities
Nice to Haves
Certifications such as CCSFP, CISSP, CISA, or a GCP security certification
Experience with GCP specifically, and with Google Workspace security
Experience governing AI tools, LLMs, or agent access to sensitive data
Scripting ability (Python or similar) to automate evidence collection and checks
Comfort using AI tools (Claude, Cursor, etc.) as a practical part of daily workflows
Requirements
Must be authorized to work in the United States; Aradigm does not sponsor work visas
Because our work includes government programs such as Medicaid, you must pass a background check and federal exclusion and debarment screening at hire and annually, and comply with our data use agreements
Compensation & Benefits
$140,000–$175,000 base salary, health coverage, equity, and 401(k). We're a flat organization, so where you start in this range depends on your experience and the impact we expect you to have from day one.
Don't meet every qualification above? Apply anyway, we'd like to hear from you.
How to apply
Interested in joining Aradigm? Please reach out to us at talent@aradigmhealth.com with:
Your full name
A link to your LinkedIn profile and/or your resume
The role you’re interested in (or the kind of work you’d like to do)
Don’t see the right role listed? Reach out anyway. We’re always looking to meet mission-driven people who care deeply about improving healthcare.
Similar roles
Principal Information Security Customer Engagement EngineerLexisNexis · Sydney · Melbourne- Sr. Software Engineer - Cloud SecurityCompa · Philadelphia
Security Operations & Detection Engineer (SecOps) – AI CloudBitdeer · Los Angeles · San Jose
Senior IAM & Information Security EngineerCaris Life Sciences
Security Operations EngineerTrueCommerce
OT Security Response EngineerModerna · Cambridge