Job description

Who We're Looking For We're looking for a senior infrastructure engineer with real security and compliance depth. You'll join Supio's DevOps team, spend most of your time building and running production infrastructure, and own our security and compliance platform as your area of the team's scope. This role suits someone who has seen how security and compliance work at scale in a larger organization and wants the autonomy to evolve that function at a fast-growing startup, someone energized by the idea that the data we protect (PII and PHI running through litigation records) is exactly the kind of data that matters most to get right. What You’ll Do • Own Infrastructure Compliance: Own Supio's SOC 2, HIPAA, and GDPR programs. Your job is to scale an audited program through automated evidence collection, remediations, and continuous control monitoring. • Build and Run Infrastructure: Work as a full member of the DevOps team on our Cloud, Kubernetes, and Terraform platform, including CI/CD and observability. • Write Production Code: Build tooling and automation. This role has real software engineering scope. • Own Access Control: Design and maintain identity and access management across cloud, source control, and internal tooling, including least privilege, access reviews, and auditability. • Remediate Vulnerabilities: Identify and remediate CVEs across infrastructure and application code, working directly with engineering to close gaps before they become incidents. You’re a Great Fit If You • Experience: 5+ years in infrastructure, platform, or SRE engineering, with direct ownership of security and compliance work at a large organization with an established program (startup experience is a plus) • Infrastructure: Strong hands-on experience with AWS, Kubernetes, and infrastructure as code (Terraform) • Software Engineering: Able to write and ship production code, not only scripts • Compliance: Hands-on experience taking systems through SOC 2, HIPAA, and GDPR audits from the engineering side • Security Remediation: Proven track record remediating CVEs across both infrastructure and software • Access Management: Experience designing and operating IAM and access controls in a cloud environment • Education: Bachelor's degree in Computer Science or related field, or equivalent practical experience • Problem Solving: Comfortable owning ambiguous, cross-cutting problems with no existing playbook, and building the process as you go • Communication: Able to translate security and compliance findings into clear, actionable guidance for engineers who aren't security specialists Nice-to-haves • Hands-on with automated security and compliance tooling (e.g., Vanta, SAST/SCA scanners, policy as code) • Experience with AI governance frameworks • Open-source contributions in security or infrastructure • Background in a PII/PHI-heavy industry: medtech, healthtech, legal tech, insurance, or defense/security Salary As an early-stage startup, we offer a competitive compensation package that includes base salary, meaningful equity, and benefits . Equity grants are designed to ensure employees share in the long-term success and upside of the company. Base Salary: $180,000 – $220,000 annually Actual compensation will be determined based on a candidate's qualifications, skills, experience, and geographic location.

Requirements

Must-haves

Who We're Looking For
What You’ll Do
Own Infrastructure Compliance: Own Supio's SOC 2, HIPAA, and GDPR programs. Your job is to scale an audited program through automated evidence collection, remediations, and continuous control monitoring.
Build and Run Infrastructure: Work as a full member of the DevOps team on our Cloud, Kubernetes, and Terraform platform, including CI/CD and observability.
Write Production Code: Build tooling and automation. This role has real software engineering scope.
Own Access Control: Design and maintain identity and access management across cloud, source control, and internal tooling, including least privilege, access reviews, and auditability.
Remediate Vulnerabilities: Identify and remediate CVEs across infrastructure and application code, working directly with engineering to close gaps before they become incidents.
You’re a Great Fit If You
Infrastructure: Strong hands-on experience with AWS, Kubernetes, and infrastructure as code (Terraform)
Software Engineering: Able to write and ship production code, not only scripts
Compliance: Hands-on experience taking systems through SOC 2, HIPAA, and GDPR audits from the engineering side
Security Remediation: Proven track record remediating CVEs across both infrastructure and software
Access Management: Experience designing and operating IAM and access controls in a cloud environment
Education: Bachelor's degree in Computer Science or related field, or equivalent practical experience
Problem Solving: Comfortable owning ambiguous, cross-cutting problems with no existing playbook, and building the process as you go
Communication: Able to translate security and compliance findings into clear, actionable guidance for engineers who aren't security specialists

Nice-to-haves

Experience: 5+ years in infrastructure, platform, or SRE engineering, with direct ownership of security and compliance work at a large organization with an established program (startup experience is a plus)
Hands-on with automated security and compliance tooling (e.g., Vanta, SAST/SCA scanners, policy as code)
Experience with AI governance frameworks
Open-source contributions in security or infrastructure
Background in a PII/PHI-heavy industry: medtech, healthtech, legal tech, insurance, or defense/security

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

kubernetesci/cdawsgoai

Platform: gem
Effort: medium