Lead Security Compliance Engineer

EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.

• Minimum 3 years in security/privacy compliance, GRC, or compliance engineering supporting HIPAA and/or FedRAMP/NIST 800-53 programs
• Strong knowledge of HIPAA Security & Privacy Rules including administrative, physical, and technical safeguards, BAAs, breach notification, minimum necessary standards
• Familiarity with NIST 800-53 control families such as AC, AU, SI, and PM
• Proven ability to translate compliance language into scoped engineering backlog items using Azure DevOps, Jira, or similar tools
• Experience supporting third-party audits (SOC 2, FedRAMP, HITRUST), including evidence collection and control-to-evidence mapping
• Familiarity with cloud environments like AWS GovCloud and/or Azure Government
• Understanding of key compliance controls including IAM/RBAC, encryption/KMS, audit logging, data retention, and deletion
• English proficiency at B2 level or higher

Nice to have:

• Experience with FedRAMP Significant Change Requests and assessor engagements
• Scripting/automation skills with Python or Bash for evidence collection and dashboard automation
• Experience with AWS IAM and identity governance tools such as SailPoint, and access policy management for S3, RDS, DynamoDB, Redshift
• Knowledge of international privacy regulations like UK/EU GDPR, Australia Privacy Act, Canada PIPEDA
• Certifications like CIPP/US, CIPM, HCISPP, CISA, CISSP, or AWS/Azure security certifications
• Experience with security-scan remediation tools like Snyk, Wiz, Qualys, Burp, and secrets/certificate rotation
• Background in legal-tech, healthcare, or government SaaS products handling regulated data

• Convert HIPAA gap analyses, NIST 800-53 privacy controls, and audit findings into scoped Azure DevOps Features/Stories/Tasks with clear acceptance criteria, effort estimates, and a named owner
• Maintain backlog hygiene across active compliance features, including access control, data classification, log scrubbing, audit logging, data retention & deletion, and data access restrictions
• Close ownership and sprint-assignment gaps before they escalate into RAID-log risks
• Write and execute test cases to verify controls such as privileged-access restrictions, time-bound SailPoint access, PII minimization, and deletion-on-request
• Document pass/fail evidence for all control testing activities
• Own the intake, tracking, and fulfillment of third-party auditor evidence requests, including Schellman FedRAMP Significant Change Reviews
• Map auditor requests to relevant NIST 800-53 controls and coordinate with engineering, ISRM, Privacy, and Legal to gather artifacts
• Deliver evidence and documentation on the auditor's schedule
• Produce recurring compliance status reports for stakeholders
• Build lightweight automation, including scripts, dashboards, and evidence pipelines, to reduce manual effort in audit cycles
• Partner with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to document controls inherited from AWS/Azure versus internally owned controls

Klikając w przycisk „Aplikuj” lub w inny sposób wysyłając zgłoszenie rekrutacyjne, zgadzasz się na przetwarzanie Twoich danych osobowych przez EPAM Systems (Poland) sp. z o.o. z siedzibą w: Fabryczna 1A, 31-553 Kraków (Pracodawca), jako administratora danych osobowych w celu przeprowadzenia rekrutacji na stanowisko wskazane w ogłoszeniu zgodnie Polityką Prywatności dostępną na stronie: https://www.epam.com/applicant-privacy-notice