Senior Security Engineer

Hospitals trust Sage with patient data, and every new health system brings security reviews and audits. As our first dedicated Security Engineer, you'll own security and compliance across our platform, applications, identity, and SaaS footprint, and you'll share ownership of the GCP and Kubernetes infrastructure that runs it. You'll set the guidelines engineering and product teams follow, implement the controls that matter most yourself, and be the technical voice in front of customer security teams.

You'll report to the Head of Core Platform, Infrastructure and Security, who serves as Sage's Security Officer and HIPAA Lead.

• Run our compliance program: SOC 2 Type II, HIPAA safeguards, risk assessments, vendor BAAs, and pen test remediation, with Vanta as the system of record. Extend it to HITRUST and international requirements as we grow.
• Lead customer security reviews, questionnaires, and audits with hospital IT and security teams across all customers, in the U.S. and MENA.
• Set security guidelines for engineering: secure design review for new services, application security standards, dependency and code scanning, and secrets handling. Decide what must be done and work with teams to get it done.
• Own governance of identity and access: Auth0, Google Workspace, SSO and MFA, access reviews, and least privilege across cloud and SaaS.
• Build and operate infrastructure alongside the DevOps team: GCP, GKE, Terraform, and CI/CD, with IAM hardening, network controls, and policy as code built in.
• Govern PHI: access policy, audit logging, retention, and security review of new data flows, including BigQuery.
• Own detection and incident response: logging and alerting, runbooks, and the breach notification process.
• Secure our AI agents: threat model prompt injection, tool misuse, and sensitive data disclosure in voice and LLM workflows.

• 5+ years in security engineering or infrastructure with security ownership.
• Hands on SOC 2 and HIPAA experience in production environments, with Vanta, Drata, or similar.
• Application security experience: secure code review, threat modeling, and CI/CD scanning.
• Identity and access management experience with Auth0, Okta, or similar, and SSO/MFA across SaaS.
• Strong GCP or AWS security, plus Kubernetes and Terraform in production.
• Proficient in Python, and able to read and review code in TypeScript and Java; Rust a plus.