Senior Platform Security Engineer (SOC 2 / HIPAA) | GovTech

Company Overview: Our client is a venture-backed govtech startup that helps families find the benefit programs they qualify for, apply to several at once and stay enrolled as rules change. State agencies, Medicaid managed care organizations and employers pay for the platform. It now runs eligibility checks and applications across federal, state and local programs. Its customers are highly regulated, so security and privacy shape how the team builds. The team is small and fully remote across the U.S. Your Role: This is not a "review and advise" security role. You build the controls yourself. State and federal buyers are asking for stricter security standards. Security and privacy are now core parts of the platform, not side projects. You'll be the senior engineer and tech lead for the platform's security, privacy and compliance controls, and the technical partner to the Trust Product Manager. The PM owns requirements, governance and the roadmap. You own the architecture and the working systems. You'll start with the engineering behind the existing SOC 2 Type II and HIPAA controls. Recurring manual work like access reviews and evidence collection moves into code. Then you'll lead the technical side of the company's NIST 800-series alignment.. What you'll do Identity & Production Access (primary focus) Design how people and services sign in, what each role is allowed to do, and where secrets are stored. Decide how engineers get into production and who approves that access. W