HIPAA Security Engineer

Overview

As a HIPAA Security Engineer at Flo, you will lead security controls for US healthcare data in a cloud-based SaaS environment. You’ll own the HIPAA and SOC 2 certification roadmaps, shaping compliance with Engineering and Legal partners. You’ll streamline evidence gathering and automate controls to support millions of users while engaging with regulators and external auditors. This role sits in Flo’s Security Architecture team and offers relocation to London with visa sponsorship. You join a mission-driven, fast-moving company building privacy-first digital health at scale.

Pay / Benefits

• Competitive salary and annual reviews
• Performance incentive scheme
• Paid holiday and sick leave
• Parental leave and pay for various family situations
• Hybrid work model with 3 days in office
• Sabbatical at 5-year anniversary

Responsibilities

• Lead annual SOC 2 and HIPAA certification programs, coordinating with external auditors and services
• Define and maintain security policies, embedding risk assessments in engineering processes and vendor management
• Collaborate to automate evidence gathering and reduce compliance friction for control owners
• Serve as the primary Security point of contact for US regulators and partners; align with ISO 27001/27701
• Manage and integrate GRC platforms to streamline monitoring and reporting

Key requirements

• 7+ years in security/compliance (3+ in leadership)
• Bachelor’s degree in a related field
• Deep expertise in SOC 2 and HIPAA within a Cloud-based SaaS environment
• Familiarity with PHI handling, GRC platforms, and compliance automation

• Ability to translate complex compliance requirements into clear actions for engineering teams
• SOC 2 and HIPAA frameworks
• Cloud-based SaaS security
• PHI handling
• GRC platforms
• Compliance automation

…