Senior Security Engineer

About the role

About Hipp

Hipp is an AI-native healthcare platform built to modernize operations for non-hospital healthcare providers. We partner closely with ambulatory healthcare organizations to streamline clinical workflows, billing, scheduling, patient engagement, and revenue cycle operations.

Our platform handles sensitive healthcare and operational data across a growing set of intelligent products. Security, privacy, reliability, and customer trust are fundamental to what we build—not separate functions applied after the fact.

Role Overview

We’re looking for a Senior Security Engineer to lead and strengthen security across Hipp’s product, cloud infrastructure, software-development lifecycle, and internal operations.

You will be a hands-on technical leader responsible for identifying risk, designing pragmatic controls, improving detection and response, and helping engineering teams ship secure systems quickly. You will work closely with engineering, IT, product, compliance, and company leadership to evolve Hipp’s security posture as the platform and customer base grow.

This role is ideal for someone who can move fluently between application security, cloud security, incident response, compliance readiness, and security architecture. You should be comfortable setting direction while also implementing controls, reviewing systems, investigating alerts, and helping teams resolve concrete security problems.

What You’ll Do

• Own and evolve Hipp’s product and infrastructure security program

• Partner with engineering teams to embed security into system design, implementation, deployment, and operations

• Conduct architecture reviews, threat modeling, code reviews, and targeted security assessments

• Strengthen cloud security across identity and access management, network controls, secrets, encryption, logging, and workload configuration

• Build and improve vulnerability-management processes across applications, dependencies, containers, infrastructure, and endpoints

• Develop security monitoring, alerting, investigation, and incident-response capabilities

• Lead incident-response preparation, including playbooks, tabletop exercises, evidence collection, and post-incident improvement

• Improve authentication, authorization, tenant isolation, privileged-access, and least-privilege controls

• Partner with engineering to secure AI-agent tools, model integrations, retrieval systems, and access to sensitive data

• Assess AI-specific threats such as prompt injection, excessive agency, insecure tool use, sensitive-data disclosure, and untrusted retrieved content

• Support HIPAA and SOC 2 compliance through technically sound, sustainable controls and evidence

• Help respond to customer security reviews, questionnaires, and technical diligence

• Evaluate vendors and integrations for security and privacy risk