Sr. Security & Compliance Engineer

The Senior Security & Compliance Engineer will serve as a technical leader in protecting Residex’s AI-powered platform, its corporate and SaaS environment, and the sensitive resident, caregiver, and operator data it manages across our growing footprint of senior living communities, setting security standards and mentoring engineers across the organization.

Responsibilities include:

• Define, review, and approve security standards and security strategy across Residex’s cloud infrastructure, applications, and 14+ integrated modules, including EHR, eMAR, and Workforce, partnering with Architecture and Engineering leadership on the designs that implement them.
• Lead security event monitoring using SIEM and EDR tooling; oversee alert triage, drive complex forensic investigations, and direct remediation efforts across engineering teams, acting as the senior escalation point for high-severity incidents.
• Direct vulnerability assessment and penetration testing programs across the platform, prioritizing findings by risk and holding engineering leadership accountable for remediation timelines.
• Own Residex’s certification program end to end, including SOC 2 Type II, HIPAA, and applicable state regulatory requirements — control design, control operation, evidence collection, and serving as the primary technical point of contact for auditors and assessors, in partnership with executive leadership. Own the ongoing response to customer security questionnaires and vendor risk assessments as standing work, maintaining a reusable library of approved control positions and supporting evidence.
• Own third-party and vendor risk management, including security review of new vendors and integrations, ongoing monitoring of critical suppliers, and the security and privacy terms Residex requires of its partners.
• Define least-privilege standards for identity and access management (IAM), including SSO, MFA, and role-based access controls, and review and approve their implementation to safeguard resident and operator data at scale.
• Mature Residex’s corporate security posture across all SaaS systems and business operations — including Microsoft Entra ID and M365, endpoint management, SaaS application governance, email security, data loss prevention, and identification and remediation of unsanctioned application use.
• Mentor engineering teams on secure coding practices, threat modeling, and security review, embedding a security-first culture across the software development lifecycle.
• Serve as the security voice in product design reviews and internal system infrastructure decisions, partnering with Product, Architecture, and Engineering to set and approve security requirements without owning delivery of those systems.
• Lead incident response planning and execution, including root-cause analysis, executive-level post-incident reporting, and continuous improvement of response playbooks.
• Drive evaluation and deployment of security tooling, such as endpoint protection, network monitoring, and secrets management, and make build-vs-buy recommendations to executive leadership to strengthen the platform’s overall security posture.
• Design and lead security awareness training and documentation programs for internal teams handling sensitive resident data, and mentor junior security engineers.

• 8+ years of experience in a cybersecurity engineering, security operations, or related technical security role, including experience leading investigations or mentoring other engineers, ideally at a B2B SaaS company.
• Deep, hands-on expertise with cloud security in AWS (preferred), Azure, or GCP, including IAM, network security groups, and logging/monitoring services, with a track record of designing security architecture at scale.
• Practical experience administering enterprise identity platforms — Microsoft Entra ID and Auth0 or equivalent — including SSO, MFA, conditional access, and privileged access management.
• Advanced experience with SIEM/EDR platforms (e.g., Splunk, CrowdStrike, Elastic) and vulnerability management tools, including tool selection and program ownership.
• Direct ownership of at least one full SOC 2 Type II or HIPAA audit cycle as the primary technical point of contact for auditors, including control design, evidence collection, and remediation of findings; working knowledge of ISO 27001 a plus.
• Hands-on experience conducting HIPAA Security Rule risk analyses and managing Business Associate Agreements and the security obligations they carry.
• Demonstrated ownership of secure software development practices, including threat modeling, code review, and CI/CD pipeline security, with experience setting standards adopted organization wide.
• Strong scripting or automation experience (Python, Bash, or similar) to streamline and scale security operations.
• Excellent communication and executive presence, with the ability to present security risk, incident findings, and remediation plans to senior leadership, the board, and both technical and non-technical stakeholders.
• Advanced security certifications strongly preferred — CISSP or CISM, with HCISPP and CCSP valued for healthcare and cloud depth; GCIH, GCFA, GCFE, CEH, or CySA+ are a plus.
• Experience in healthcare, senior living, or another highly regulated industry strongly preferred; genuine interest in protecting sensitive resident and caregiver data is valued, along with prior experience mentoring or informally leading other security engineers.