出海雷达

安全与合规工程师_远程

Security and Compliance Engineer_Offshore

开发工程限定地区（需当地身份）
公司Photon
薪资未公开
工作地点India
地域资格限定地区（需当地身份）
时区要求日间重叠约 6 小时，基本正常作息
用工类型Full Time
发布时间13 天前
数据来源Himalayas
前往 Himalayas 查看并投递 →
注意地域限制：该职位明确限定在 India 招聘。如果你是位于中国大陆的求职者，通常需要当地工作身份才能投递，或需与雇主确认是否接受独立合同（Contractor）形式合作。

职位描述
我们正在寻找一位注重细节、亲力亲为的安全与合规工程师，以推动我们应用程序、基础设施和合规项目的安全性——特别是在医疗健康领域。该职位结合了安全工程、DevSecOps 和风险管理，重点关注应用、云、AI 和数据安全。
你将与工程、DevOps 和合规团队紧密合作，将安全嵌入开发生命周期，支持监管框架，并确保云原生环境和 AI 技术在设计时就是安全的。

职责

  • 在我们的平台上开展网页和移动应用渗透测试、漏洞扫描及修复支持。
  • 将 DevSecOps 实践集成到 CI/CD 流水线中，使用 Snyk、Terraform 和容器安全扫描工具等。
  • 实施并监控云安全态势管理（CSPM）工具，如 Wiz，以保护云配置和基础设施。
  • 与 DevOps 合作，通过基础设施即代码（IaC）实现安全配置。
  • 使用 Drata（合规即服务）等平台领导和支持合规项目（HIPAA、SOC 2、HITRUST）。
  • 设计和增强电子邮件网关安全（如 Barracuda）和机器人防护（如 WatchGuard），以抵御钓鱼攻击和自动化威胁。
  • 评估并保护聊天机器人和 AI 系统，解决提示注入、数据泄露和模型完整性等风险。
  • 推动数据安全最佳实践，包括加密、数据丢失防护（DLP）和分类策略。
  • 与工程团队合作，在产品设计中嵌入安全控制，进行威胁建模、安全代码审查和架构审查。
  • 参与事件检测、响应和根本原因分析，同时确保有效的日志记录和监控机制到位。
  • 维护安全文档，并支持审计和第三方评估。

所需技能与资格

  • 4-6 年安全工程、合规和 DevSecOps 相关经验。
  • 精通网页和移动应用安全，包括 OWASP Top 10、SAST/DAST 工具以及使用 Burp Suite 等工具的手动测试。
  • 对 DevSecOps 流程有深入了解，具备 Snyk、Terraform 和容器安全工具的实际操作经验。
  • 深入理解 HIPAA、SOC 2 和医疗健康合规要求。
  • 具备云安全经验，最好是 Microsoft Azure，熟悉相关技术。
查看英文原文

About the Role
We're seeking a hands-on and detail-oriented Security and Compliance Engineer to drive security across our applications, infrastructure, and compliance programs-especially in a healthcare environment. This role combines security engineering, DevSecOps, and risk management with a strong focus on application, cloud, AI, and data security.
You will work closely with engineering, DevOps, and compliance teams to embed security into the development lifecycle, support regulatory frameworks, and ensure cloud-native environments and AI technologies are secure by design.
Responsibilities

  • Conduct web and mobile application penetration testing, vulnerability scanning, and remediation support across our platforms.
  • Integrate DevSecOps practices into CI/CD pipelines, using tools like Snyk, Terraform, and container security scanners.
  • Implement and monitor Cloud Security Posture Management (CSPM) tools such as Wiz to secure cloud configurations and infrastructure.
  • Partner with DevOps to enforce secure provisioning via Infrastructure as Code (IaC).
  • Lead and support compliance initiatives (HIPAA, SOC 2, HITRUST) using platforms like Drata (Compliance-as-a-Service).
  • Design and enhance email gateway security (e.g., Barracuda) and bot protection (e.g., WatchGuard) to defend against phishing and automated threats.
  • Evaluate and secure chatbots and AI systems, addressing risks like prompt injection, data leakage, and model integrity.
  • Drive data security best practices including encryption, data loss prevention (DLP), and classification strategies.
  • Collaborate with engineering to embed security controls in product design and conduct threat modeling, secure code reviews, and architecture reviews.
  • Participate in incident detection, response, and root cause analysis, while ensuring effective logging and monitoring are in place.
  • Maintain security documentation and support audits and third-party assessments.

Required Skills & Qualifications

  • 4-6 years of experience in security engineering, compliance, and DevSecOps.
  • Proficiency in web and mobile application security, including OWASP Top 10, SAST/DAST tools, and manual testing with Burp Suite, etc.
  • Strong exposure to DevSecOps workflows, with hands-on experience using tools like Snyk, Terraform, and container security.
  • Deep understanding of HIPAA, SOC 2, and healthcare compliance requirements.
  • Experience with cloud security, preferably on Microsoft Azure, and familiarity with CSPM tools like Wiz.
  • Working knowledge of Drata or similar compliance automation platforms.
  • Exposure to email security gateways, bot protection, and threat detection tools.
  • Familiarity with AI and chatbot security concepts and current risks in the generative AI space.
  • Strong grasp of data security principles-encryption, access controls, data classification, and DLP.
  • Scripting or automation skills in Python, Bash, or equivalent are a plus.
  • Strong written and verbal communication, documentation, and collaboration skills.

Nice to Have

  • Certifications like OSCP, CEH, CCSK, CISSP, HCISPP, or similar.
  • Familiarity with tools like KnowBe4, Intune, or Azure AD for identity and endpoint security.
  • Understanding of Zero Trust Architecture, RBAC, and endpoint detection and response (EDR) strategies.
  • Previous experience in a health tech, SaaS, or AI-focused organization.

Why Join Us

  • Make a real impact in securing healthcare and AI systems at scale.
  • Collaborate in a high-ownership environment with modern tools and cloud-native practices.
  • Work in a security-forward company that values both innovation and compliance.
  • Flexible work environment and growth opportunities in a fast-paced tech culture.

Originally posted on Himalayas

本页面信息整理自 Himalayas，版权归原发布方所有。职位可能随时关闭，投递请以原始页面为准。 本站只做信息聚合展示，不参与招聘流程，也不向求职者收取任何费用。

该公司其他在招职位

← 返回全部职位