Senior Security Engineer

About Sage Care

Sage Care is a fast growing, early stage healthcare startup transforming care navigation with AI. Our platform helps patients find the right care, enables providers to focus on the people who need them most, and improves access, quality, and economic outcomes at scale.

Founded by leaders from Apple, Uber, and Carbon Health, Sage Care is backed by top tier investors including General Catalyst and Chelsea Clinton. We work with health systems across the U.S. and have expanded internationally to the MENA region.

About the Role

Hospitals trust Sage with patient data, and every new health system brings security reviews and audits. As our first dedicated Security Engineer, you'll own security and compliance across our platform, applications, identity, and SaaS footprint, and you'll share ownership of the GCP and Kubernetes infrastructure that runs it. You'll set the guidelines engineering teams follow, implement the controls that matter most yourself, and be the technical voice in front of customer security teams.

You'll report to the Head of Core Platform, Infrastructure and Security, who serves as Sage's Security Officer and HIPAA Lead.

What You'll Do

• Run our compliance program: SOC 2 Type II, HIPAA safeguards, risk assessments, vendor BAAs, and pen test remediation, with Vanta as the system of record. Extend it to HITRUST and international requirements as we grow.

• Lead customer security reviews, questionnaires, and audits with hospital IT and security teams across all customers, in the U.S. and MENA.

• Set security guidelines for engineering: secure design review for new services, application security standards, dependency and code scanning, and secrets handling. Decide what must be done and work with teams to get it done.

• Own identity and access: Auth0, Google Workspace, SSO and MFA, access reviews, and least privilege across cloud and SaaS.

• Build and operate infrastructure alongside the DevOps team: GCP, GKE, Terraform, and CI/CD, with IAM hardening, network controls, and policy as code built in.

• Govern PHI: access policy, audit logging, retention, and security review of new data flows, including BigQuery.

• Own detection and incident response: logging and alerting, runbooks, and the breach notification process.

• Secure our AI agents: threat model prompt injection, tool misuse, and sensitive data disclosure in voice and LLM workflows.

What We're Looking For

Required

• 5+ years in security engineering or infrastructure with security ownership.

• Hands on SOC 2 and HIPAA experience in production environments, with Vanta, Drata, or similar.

• Application security experience: secure code review, threat modeling, and CI/CD scanning.

• Identity and access management experience with Auth0, Okta, or similar, and SSO/MFA across SaaS.

• Strong GCP or AWS security, plus Kubernetes and Terraform in production.

• Scripting in Python or Go.

• Clear communication with engineers, auditors, and customer security teams; comfortable leading customer facing reviews.

Nice to Have

• Healthcare experience handling PHI.

• HITRUST, ISO 27001, or UAE or other international healthcare compliance.

• Securing LLM or voice AI products.

• Experience as an early or first security hire at a startup.

How We Work

At Sage Care, our values shape how we build, collaborate, and serve.

• Do Good Through Serving People: We serve users, teammates, and communities with integrity, compassion, kindness, and optimism.

• Innovate with Safety, Evidence, and Transparency: We move quickly while prioritizing trust, safety, ethical decision making, and evidence based approaches.

• Lead with Curiosity and Kindness: We ask questions before making assumptions and approach discovery, debate, and problem solving with humility and care.

• We, Not Me: We believe the best work happens through collaboration, mutual respect, and constructive feedback.

• Efficiency and AI in All We Do: We use automation and AI thoughtfully to work smarter, create leverage, and build better products.