HIPAA Security Engineer

About the role

<div class="content-intro"><p><strong>500M+ downloads. 80M+ monthly users. A decade of building – and we’re still accelerating.</strong></p> <p>Flo is the world’s #1 health &amp; fitness app worldwide on a mission to build a better future for female health. Backed by a $200M investment led by General Atlantic, we became the first product of our kind to reach a $1B valuation in 2024 – and we’re not slowing down.</p> <p>With 7M paid subscribers and the highest-rated experience in the App Store’s health category, we’ve spent 10 years earning trust at scale. Now, we’re building the next generation of digital health – AI-powered, privacy-first, clinically backed – to help our users know their body better.</p> <p><strong>The job</strong></p></div><p>We are seeking a HIPAA Security Engineer&nbsp;to join our team in <strong data-path-to-node="9,0" data-index-in-node="75">London, UK</strong>. While this posting is open to candidates currently based in the United States, <strong data-path-to-node="9,0" data-index-in-node="166">this position requires full-time relocation to London</strong>. We offer comprehensive visa sponsorship and a full relocation support package to ensure a smooth transition for the selected candidate.As a key member of Flo’s Security Architecture team, you will lead the design and operation of our US Healthcare security controls. You will own the roadmap for <strong>HIPAA compliance and SOC2 Type II certification</strong>, partnering with Engineering and Legal to build a secure, compliant platform for millions of users.</p> <p data-path-to-node="5"><strong>Key Responsibilities</strong></p> <ul data-path-to-node="6"> <li> <p data-path-to-node="6,0,0"><strong>Compliance Leadership:</strong> Lead annual SOC 2 and HIPAA certifications, managing interfaces with external auditors and professional services.</p> </li> <li> <p data-path-to-node="6,1,0"><strong>Policy &amp; Risk:</strong> Define and maintain security policies; embed risk assessment activities within engineering processes and vendor management.</p> </li> <li> <p data-path-to-node="6,2,0"><strong>Operational Excellence:</strong> Partner with control owners to automate evidence gathering and ensure controls reduce friction rather than creating it.</p> </li> <li> <p data-path-to-node="6,3,0"><strong>Stakeholder Management:</strong> Serve as the primary Security POC for US regulators and partners; support the wider Security team with ISO 27001/27701 alignment.</p> </li> <li> <p data-path-to-node="6,4,0"><strong>Tooling:</strong> Manage and integrate GRC platforms to streamline compliance monitoring and reporting.</p> </li> </ul> <p data-path-to-node="7"><strong>Qualifications</strong></p> <ul data-path-to-node="8"> <li> <p data-path-to-node="8,0,0"><strong>Experience:</strong> 7+ years in security/compliance (3+ in leadership), with a Bachelor’s degree in a related field.</p> </li> <li> <p data-path-to-node="8,1,0"><strong>Core Skills:</strong> Deep expertise in <strong>SOC 2 and HIPAA</strong> frameworks within a <strong>Cloud-based SaaS</strong> environment.</p> </li> <li> <p data-path-to-node="8,2,0"><strong>Technical Knowledge:</strong> Familiarity with PHI handling, GRC platforms, and compliance automation.</p> </li> <li> <p data-path-to-node="8,3,0"><strong>Soft Skills:</strong> Strong ability to translate complex compliance requirements into clear actions for engineering teams.</p> </li> </ul> <p data-path-to-node="9"><strong>Preferred:</strong> CISA/CISSP certifications; experience with NIST, HiTrust, Docker/Kubernetes, and DevSecOps.</p> <p data-path-to-node="9">&nbsp;</p> <p data-path-to-node="9">&nbsp;</p><div class="content-conclusion"><p><strong>How we work</strong></p> <p>We’re a mission-led, product-driven team. We move fast, stay focused and take ownership – from brief to build to impact. Debate is encouraged. Decisions are shared. We care about craft, ship with purpose, and always raise the bar.</p> <p>You’ll be working with people who take their

Skills