{"schemaVersion":"jobsearcher.job.v1","id":"cc22a146410fe4196814a2e2","url":"https://jobsearcher.com/jobs/cc22a146410fe4196814a2e2","canonicalUrl":"https://jobsearcher.com/jobs/cc22a146410fe4196814a2e2","title":"Lead Security Engineer","description":"EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting-edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.We are looking for a Lead Security Engineer to join our team. This role sits at the crossroads of legal/compliance obligations and hands-on engineering execution - interpreting raw regulatory or audit language, breaking it down into actionable technical tasks, driving that work through to completion, and managing the evidence-gathering process for external audits. Over time, this program will grow to encompass additional government and commercially regulated clients, as well as country-specific privacy frameworks across the UK, EU, Australia, and Canada.ResponsibilitiesConvert regulatory and audit language into concrete, actionable backlog items by transforming HIPAA gap assessments, NIST 800-53 privacy controls, and audit findings into well-defined Azure DevOps Features, Stories, and Tasks complete with acceptance criteria, effort estimates, and assigned ownership, such as reshaping \"HIPAA privacy requirements not yet defined\" into a clear engineering deliverableMonitor delivery progress and keep the backlog organized across live compliance initiatives, including access control, data classification, log scrubbing, audit logging, data retention and deletion, and data access restrictions, closing gaps in ownership or sprint planning before they turn into RAID-log issuesDevelop and run test cases confirming that controls operate as intended, such as privileged-access limitations, time-bound SailPoint access, PII minimization, and deletion-on-request functionality, capturing pass/fail results as supporting documentationManage the complete audit support lifecycle, from intake through tracking and fulfillment of third-party auditor evidence requests, such as Schellman FedRAMP Significant Change Reviews, linking each request to its corresponding NIST 800-53 control, working with engineering, ISRM, Privacy, and Legal to compile artifacts, and meeting the auditor's timelineGenerate ongoing compliance status updates for stakeholders and develop streamlined automation, including scripts, dashboards, and evidence pipelines, to cut down on manual work in future audit cycles as the program grows to serve new clients and regionsCollaborate across departments, working with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to distinguish and document controls inherited from AWS/Azure (FedRAMP, SOC 2) versus those requiring internal ownership and developmentRequirementsAt least 5 years of relevant experience in security/privacy compliance, GRC, or compliance engineering, supporting HIPAA and/or FedRAMP/NIST 800-53 initiativesA minimum of one year of experience leading and managing teamsStrong familiarity with the HIPAA Security & Privacy Rules, covering administrative, physical, and technical safeguards, BAAs, breach notification requirements, and minimum necessary principles, as well as NIST 800-53 control families such as AC, AU, SI, and PMProven capability to convert compliance and regulatory text into scoped, estimable engineering backlog items using platforms like Azure DevOps, Jira, or similarHands-on experience supporting third-party audits, including SOC 2, FedRAMP, or HITRUST, covering evidence gathering, mapping controls to evidence, and meeting auditor timelinesWorking knowledge of cloud environments, such as AWS GovCloud and/or Azure Government, along with compliance-relevant controls, including IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion practicesExcellent English communication skills (B2 level or higher)Nice to haveHands-on experience with FedRAMP Significant Change Requests (SCR) and working directly with assessorsAbility to script and automate tasks using Python or Bash to streamline evidence gathering, control testing, or compliance dashboard creationExperience with AWS IAM and identity governance platforms, such as SailPoint or similar tools, along with managing access policies across S3, RDS, DynamoDB, and RedshiftFamiliarity with international privacy regulations, such as UK/EU GDPR, Australia's Privacy Act, or Canada's PIPEDA, or willingness to quickly develop expertise as the program's scope broadensRelevant industry certifications, such as CIPP/US, CIPM, HCISPP, CISA, CISSP, or a security certification from AWS or AzureExperience tracking remediation from security scanning tools, such as Snyk, Wiz, Qualys, or Burp, along with managing programs for secrets and certificate rotationPrior experience supporting legal-tech, healthcare, or government SaaS platforms that manage regulated dataWe offerInternational projects with top brandsWork with global teams of highly skilled, diverse peersHealthcare benefitsEmployee financial programsPaid time off and sick leaveUpskilling, reskilling and certification coursesUnlimited access to the LinkedIn Learning library and 22,000+ coursesGlobal career opportunitiesVolunteer and community involvement opportunitiesEPAM Employee GroupsAward-winning culture recognized by Glassdoor, Newsweek and LinkedInEPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.","company":"EPAM Systems","rawCompany":"epam systems","city":"Westminster","state":"MD","isRemote":false,"isActive":false,"createdAt":"2026-09-03T09:00:01.029Z","occupations":[{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"},{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"},{"code":"15-1212.00","title":"Information Security Analysts","slug":"information-security-analysts"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"},{"code":"541511","title":"Custom Computer Programming Services","slug":"custom-computer-programming-services"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"Lead Security Engineer","description":"EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting-edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.We are looking for a Lead Security Engineer to join our team. This role sits at the crossroads of legal/compliance obligations and hands-on engineering execution - interpreting raw regulatory or audit language, breaking it down into actionable technical tasks, driving that work through to completion, and managing the evidence-gathering process for external audits. Over time, this program will grow to encompass additional government and commercially regulated clients, as well as country-specific privacy frameworks across the UK, EU, Australia, and Canada.ResponsibilitiesConvert regulatory and audit language into concrete, actionable backlog items by transforming HIPAA gap assessments, NIST 800-53 privacy controls, and audit findings into well-defined Azure DevOps Features, Stories, and Tasks complete with acceptance criteria, effort estimates, and assigned ownership, such as reshaping \"HIPAA privacy requirements not yet defined\" into a clear engineering deliverableMonitor delivery progress and keep the backlog organized across live compliance initiatives, including access control, data classification, log scrubbing, audit logging, data retention and deletion, and data access restrictions, closing gaps in ownership or sprint planning before they turn into RAID-log issuesDevelop and run test cases confirming that controls operate as intended, such as privileged-access limitations, time-bound SailPoint access, PII minimization, and deletion-on-request functionality, capturing pass/fail results as supporting documentationManage the complete audit support lifecycle, from intake through tracking and fulfillment of third-party auditor evidence requests, such as Schellman FedRAMP Significant Change Reviews, linking each request to its corresponding NIST 800-53 control, working with engineering, ISRM, Privacy, and Legal to compile artifacts, and meeting the auditor's timelineGenerate ongoing compliance status updates for stakeholders and develop streamlined automation, including scripts, dashboards, and evidence pipelines, to cut down on manual work in future audit cycles as the program grows to serve new clients and regionsCollaborate across departments, working with ISRM, Privacy Office, Legal, SRE, and cloud platform teams to distinguish and document controls inherited from AWS/Azure (FedRAMP, SOC 2) versus those requiring internal ownership and developmentRequirementsAt least 5 years of relevant experience in security/privacy compliance, GRC, or compliance engineering, supporting HIPAA and/or FedRAMP/NIST 800-53 initiativesA minimum of one year of experience leading and managing teamsStrong familiarity with the HIPAA Security & Privacy Rules, covering administrative, physical, and technical safeguards, BAAs, breach notification requirements, and minimum necessary principles, as well as NIST 800-53 control families such as AC, AU, SI, and PMProven capability to convert compliance and regulatory text into scoped, estimable engineering backlog items using platforms like Azure DevOps, Jira, or similarHands-on experience supporting third-party audits, including SOC 2, FedRAMP, or HITRUST, covering evidence gathering, mapping controls to evidence, and meeting auditor timelinesWorking knowledge of cloud environments, such as AWS GovCloud and/or Azure Government, along with compliance-relevant controls, including IAM/RBAC, encryption/KMS, audit logging, and data retention and deletion practicesExcellent English communication skills (B2 level or higher)Nice to haveHands-on experience with FedRAMP Significant Change Requests (SCR) and working directly with assessorsAbility to script and automate tasks using Python or Bash to streamline evidence gathering, control testing, or compliance dashboard creationExperience with AWS IAM and identity governance platforms, such as SailPoint or similar tools, along with managing access policies across S3, RDS, DynamoDB, and RedshiftFamiliarity with international privacy regulations, such as UK/EU GDPR, Australia's Privacy Act, or Canada's PIPEDA, or willingness to quickly develop expertise as the program's scope broadensRelevant industry certifications, such as CIPP/US, CIPM, HCISPP, CISA, CISSP, or a security certification from AWS or AzureExperience tracking remediation from security scanning tools, such as Snyk, Wiz, Qualys, or Burp, along with managing programs for secrets and certificate rotationPrior experience supporting legal-tech, healthcare, or government SaaS platforms that manage regulated dataWe offerInternational projects with top brandsWork with global teams of highly skilled, diverse peersHealthcare benefitsEmployee financial programsPaid time off and sick leaveUpskilling, reskilling and certification coursesUnlimited access to the LinkedIn Learning library and 22,000+ coursesGlobal career opportunitiesVolunteer and community involvement opportunitiesEPAM Employee GroupsAward-winning culture recognized by Glassdoor, Newsweek and LinkedInEPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.","datePosted":"2026-09-03T09:00:01.029Z","dateModified":"2026-09-03T09:00:01.029Z","hiringOrganization":{"@type":"Organization","name":"EPAM Systems","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Westminster","addressRegion":"MD","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"cc22a146410fe4196814a2e2"},"url":"https://jobsearcher.com/jobs/cc22a146410fe4196814a2e2"}}