Note: The job is a remote job and is open to candidates in USA. AxisCare is a fast-growing SaaS company providing a web-based management platform for home care agencies. The Senior Security Engineer will own security and compliance across the platform, including SOC 2 Type II and HITRUST initiatives, AWS and container security, threat modeling, security scanning, and incident response. The role will also assess risks in AI-powered products and establish guardrails for AI-assisted development.
Responsibilities
- Own AxisCare Engineering's security program as an individual contributor. Continually improve our security standards as threats evolve, strengthen the systems that enforce them, and work directly with engineers to close gaps
- Own engineering's share of SOC 2 Type II compliance: control design, evidence collection, audit prep, and gap remediation. Chart the path toward HITRUST certification, mapping what we already have and building what we don't
- Threat-model our application and infrastructure. We run a PHP/React modular monolith on AWS, managed with Terraform, deployed in Docker containers, backed by MySQL in RDS. Raise the bar on this stack's security (IAM policies, VPC design, secrets management, container security, database access controls) and keep raising it as the architecture evolves
- Own and improve our security scanning program. Tune findings, cut false positives, and make sure scan results turn into developer action
- Assess and mitigate the security risks inherent in our AI products: prompt injection, data leakage, model output filtering, abuse scenarios. Set guardrails for AI-assisted development workflows so the team ships faster without opening new attack surface
- Strengthen our detection and response capabilities: logging, alerting, incident response playbooks. Coordinate penetration tests, track findings, and drive remediation
- Keep our security policies clear, current, and short. Train developers on secure practices without burying them in process
Skills
- * 5+ years in application security, infrastructure security, or security engineering at a SaaS company
- * Hands-on experience with AWS security (IAM, VPC, Security Groups, KMS, CloudTrail, GuardDuty)
- * Experience owning or heavily contributing to the engineering side of SOC 2 Type II compliance
- * Familiarity with container security (Docker, Kubernetes) and infrastructure-as-code (Terraform)
- * Solid grasp of web application security fundamentals (OWASP Top 10, secure SDLC)
- * Experience securing AI/ML systems or LLM-powered products
- * Concrete examples of how you've used AI to improve your own security work: automating compliance tasks, speeding up threat analysis, building detection rules faster, or something we haven't thought of
- * Able to work remotely from the Eastern, Central, or Mountain time zones
- * Qualified to work in the United States or Canada
- * Manual dexterity required to use desktop computer and peripherals
- * Experience building or maintaining HIPAA-compliant or HITRUST-certified environments
- * CISSP, OSCP, or AWS Security Specialty certification
- * Background in penetration testing or red team work
Benefits
- Medical insurance is covered in full for the employee (Medical, Dental, and Vision)
- Company will provide laptop and other needed computer equipment
- Fully remote work arrangement
Company Overview