资深云安全工程师
Staff Cloud Security Engineer
在Included Health，安全是成员、客户、合作伙伴和护理团队对我们信任的核心。我们通过将安全融入架构、工程实践和日常运营来保护敏感的健康信息以及支持我们产品的系统。
我们的安全工程团队与平台工程和产品团队紧密合作，构建实用且可扩展的安全控制措施，特别是针对我们的基础设施即代码（IaC）。我们通过自动化、默认安全模式、强大的技术合作以及团队可以在实际生产环境中操作的控制措施来降低风险。
作为安全团队的云工程师，你将帮助提升Included Health在AWS环境中的云安全态势，同时考虑GCP。你将设计、实施并自动化保护产品基础设施的控制措施，防止未经授权的受保护健康信息（PHI）泄露。
这是一份全职远程职位，汇报对象为安全工程高级经理。我们考虑在高级和资深级别候选人的可能性。
该职位需要具备实际的技术执行能力，以及影响基础设施、DevOps、工程和产品团队的能力。
你将负责
- 在身份和访问管理（IAM）、授权、即时访问、数据访问和平台访问方面设计并自动化云安全控制。
- 通过Terraform防护措施、风险路线图、遗留问题修复和安全基础设施模式提升AWS和GCP的安全态势。
- 使用Python、Go和Lambda构建安全工具，用于漏洞管理、警报、PHI日志记录和云安全工作流程。
- 通过团队可在生产环境中操作的实际控制措施，确保容器、工作负载和CI/CD流水线的安全。
- 与基础设施、DevOps、工程和产品团队合作处理敏感数据、事件响应和安全平台计划。
- 记录控制措施、标准、自动化和演练方案，帮助团队采用安全的工作流程。
你具备以下特质
你是一位务实、动手能力强的云安全工程师，能够在没有完全清晰的情况下为模糊的风险或控制缺口带来结构。你明确期望的结果、信任边界、相关方、限制条件和可用事实，然后做出合理的初步行动，并在学习过程中不断调整。
你能够深入代码、云API、日志、身份策略和网络配置。
查看英文原文
At Included Health, security is central to the trust our members, customers, partners, and care teams place in us. We protect sensitive health information and the systems that support our products by building security into architecture, engineering practices, and day-to-day operations.
Our Security Engineering team works closely with platform engineering and product teams to build practical, scalable security controls, especially focused on our infrastructure-as-code. We focus on reducing risk through automation, secure-by-default patterns, strong technical partnerships, and controls that teams can operate in real production environments.
As a Cloud Engineer on the Security team, you’ll help mature Included Health’s cloud security posture across primarily AWS environments, with consideration for GCP. You’ll design, implement, and automate controls that protect product infrastructure and help prevent unauthorized Protected Health Information (PHI) exfiltration.
This is a full-time, remote role reporting to the Senior Manager, Security Engineering. We are open to considering candidates at both the Senior and Staff levels.
The role requires hands-on technical execution as well as the ability to influence infrastructure, DevOps, engineering, and product teams.
What You'll Do
- Design and automate cloud security controls across Identity & Access Management (IAM), authorization, Just-in-Time access, data access, and platform access.
- Improve AWS and GCP security posture through Terraform guardrails, risk roadmaps, legacy remediation, and secure infrastructure patterns.
- Build security tooling in Python, Go, and Lambda for vulnerability management, alerting, PHI logging, and cloud security workflows.
- Secure containers, workloads, and CI/CD pipelines through practical controls teams can operate in production.
- Partner with infrastructure, DevOps, engineering, and product teams on sensitive-data handling, incident response, and secure platform initiatives.
- Document controls, standards, automation, and playbooks that help teams adopt secure workflows.
Who You Are
You are a practical, hands-on cloud security engineer who can bring structure to ambiguous risks or control gaps without waiting for perfect clarity. You clarify the desired outcome, trust boundaries, stakeholders, constraints, and available facts, then make a reasonable first move and adapt as you learn.
You are comfortable going deep in code, cloud APIs, logs, identity policies, network traffic, CI/CD pipelines, and infrastructure configuration. You use evidence to test hypotheses and turn findings into durable fixes, reusable automation, clear documentation, or repeatable processes.
You build trust through preparation, responsiveness, direct communication, technical credibility, and follow-through. You listen to operational realities, explaining risks and tradeoffs clearly, and work with teams toward practical controls they can operate in production.
You take ownership through the full loop: coordination, escalation, validation, closure, and knowledge sharing. You know when to investigate independently, when to involve the right expertise, and when broader organizational alignment is needed.
What You Bring
- 5+ years of hands-on cloud security experience, with deep AWS expertise and familiarity with GCP.
- Strong technical depth across cloud infrastructure, identity, authorization, networking, containers, CI/CD, logging, monitoring, and security operations.
- Experience building security automation and infrastructure tooling in Python, Go, Terraform, and cloud-native services.
- Experience designing and operating access controls, including RBAC, ABAC, policy-as-code, granular engineering access, and Just-in-Time access.
- Familiarity applying cloud security frameworks, HIPAA requirements, and related standards to production environments.
- Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
Pay:
We are open to considering candidates at both the Senior and Staff levels.
The United States new hire base salary target ranges for this full-time position are:
- Zone A: $130,050–$249,930 + equity + benefits
- Zone B: $143,055–$274,923 + equity + benefits
- Zone C: $156,060–$299,616 + equity + benefits
- Zone D: $169,065–$324,909 + equity + benefits
This range reflects the minimum and maximum target for new hire salaries for candidates based on their respective Zone. Below is additional information on Included Health's commitment to maintaining transparent and equitable compensation practices across our distinct geographic zones.
Starting base salary for you will depend on several job-related factors, unique to each candidate, which may include education; training; skills; years and depth of experience; certifications and licensure; our needs; internal peer equity; organizational considerations; and understanding of geographic and market data. Compensation structures and ranges are tailored to each zone's unique market conditions to ensure that all employees receive fair and great compensation package based on their roles and locations. Your Recruiter can share your geographic zone upon inquiry.
Benefits & Perks:
In addition to receiving a great compensation package, the compensation package may include, depending on the role, the following and more:
Remote-first culture
401(k) savings plan through Fidelity
Comprehensive medical, vision, and dental coverage through multiple medical plan options (including disability insurance)
Paid Time Off ("PTO") and Discretionary Time Off ("DTO")
12 weeks of 100% Paid Parental leave
Family Building & Compassionate Leave: Fertility coverage, $25,000 for surrogacy/adoption, and paid leave for failed treatments, adoption or pregnancies.
Work-From-Home reimbursement to support team collaboration home office work
Your recruiter will share more about the salary range and benefits package for your role during the hiring process.
About Included Health
Included Health is a new kind of healthcare company, delivering integrated virtual care and navigation. We’re on a mission to raise the standard of healthcare for everyone. We break down barriers to provide high-quality care for every person in every community — no matter where they are in their health journey or what type of care they need, from acute to chronic, behavioral to physical. We offer our members care guidance, advocacy, and access to personalized virtual and in-person care for everyday and urgent care, primary care, behavioral health, and specialty care. It’s all included. Learn more at.
-----
Included Health is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics or any other basis forbidden under federal, state, or local law. Included Health considers all qualified applicants with arrest or conviction records in accordance with the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance, and California law.
Originally posted on Himalayas