Senior / Staff Platform Security Engineer

• Security architecture and roadmap: Within your first 30-60 days, assess the platform, find the risks yourself, and present a prioritized security roadmap. Then design and carry out the fixes.
  
• External credibility: Be the company's technical security voice with partner compliance and security teams, customer security reviews and questionnaires, and external auditors. When you speak on security, your word needs to carry weight.
  
• Secure development under a regulated medical-device process (ISO 13485): Lead security in design reviews at every stage: security requirements during planning, owning and updating threat models during design, checking that controls are built as designed, verification and validation, release review, and monitoring after release.
  
• Platform security: Design and harden the production path: Azure Front Door and WAF, API gateway, NGINX ingress, multi-cluster AKS (1,000+ pods), Azure SQL, and Blob Storage.
  
• Application security with engineers: Work directly with software engineers to improve application and API security, including authorization design and tenant isolation in a platform where each tenant has dedicated resources.
  
• Partner and integration security: Secure partner APIs and third-party access, give each vendor only the data and endpoints it needs, and lead the technical response when a partner has an incident.
  
• Vulnerability management: Own triage of findings from the security scanning tools (Aikido, Probly), set the timeframes for fixes, and make sure engineering meets them.
  
• Identity and access: Set and enforce policy for Entra ID, role-based access, privileged identity management (PIM), just-in-time access, and user lifecycle, working with the IT manager.
  
• Detection and incident response: Build monitoring and alerting, investigate unusual activity, and lead containment, breach assessment, and communication with stakeholders.
  
• Compliance support: Work with the security and privacy compliance manager to implement and test controls and produce evidence for SOC 2, HIPAA, and ISO 27001 (Vanta).
  

Requirements

• 6+ years in technical infrastructure or security roles, including + years in security engineering.
  
• A current or recent Senior, Staff, Lead, or Principal title in a role such as Cloud Security Engineer, Security Engineer, Platform Security Engineer, Infrastructure Security Engineer, Cybersecurity Engineer, or Security Architect. A background in DevOps or SRE is fine, but your most recent work should be security engineering. Candidates whose recent experience is mainly DevOps or DevSecOps pipeline work, SOC or security analysis, or compliance won't be a strong fit.
  
• You've designed and built cloud security architecture, not only operated infrastructure someone else designed.
  
• You've owned security without someone above you directing it. You've independently found risks, worked out how to fix them, and driven the fixes through engineering teams, without a security architect or manager setting the direction.
  
• You've owned meaningful responsibility in at least most of these areas: application security, identity and access, network security, vulnerability management, and incident response.
  
• Confident, direct communication. You can push back on engineers and leadership when it's warranted, explain risk in business terms, and hold your ground with partner security teams, customer compliance teams, and auditors.
  
• Hands-on Azure security: Entra ID, managed and workload identities, RBAC, PIM, Key Vault, Defender for Cloud, Sentinel or similar, private endpoints, and least-privilege design.
  
• AKS and Kubernetes security: Kubernetes RBAC, workload identity, secrets, network policies, pod security, admission and policy controls, ingress controls, runtime protection, and workload isolation.
  
• Application and API security: authentication and authorization design, object-level permission flaws (BOLA/IDOR), multi-tenant isolation, rate limiting, and API key management.
  
• Secure development tooling and supply chain: SAST, DAST, dependency scanning (SCA), secret scanning, infrastructure-as-code and container scanning, CVE/CVSS triage, CI/CD security gates, image signing and provenance, and container registries.
  
• Network security: WAFs, firewalls, segmentation, private endpoints, inbound and outbound traffic controls, reducing attack surface, and zero-trust principles.
  
• Detection and incident response: SIEM telemetry, identity events, cloud audit logs, writing detections, investigation, containment, and rotating or revoking credentials.
  
• Infrastructure as code with Terraform, Bicep, or ARM, including policy-as-code (Azure Policy, OPA/Gatekeeper, or similar).
  
• Still hands-on at the keyboard. You should be able to describe controls you personally designed and configured: the tools, the design decisions, the problems you hit, and how you validated the control.
  

• Healthcare SaaS, medical-device or FDA-regulated software, fintech, or another high-assurance environment.
  
• Experience representing security in customer security reviews, partner due diligence, or external audits (HIPAA, SOC 2, ISO 27001, or ISO 13485).
  
• Microsoft Defender for Cloud, Sentinel, Azure Policy, Log Analytics, CrowdStrike, Aikido, Vanta, or New Relic.
  
• GitHub Actions or Azure DevOps.
  
• SAML, OIDC, SCIM, SSO, MFA, and Conditional Access.
  
• .NET, Angular, or security automation in Python, Go, Bash, or PowerShell.
  
• Certifications such as Azure Security Engineer Associate, CKS, CCSP, or CISSP, backed by hands-on implementation experience.
  

Benefits

• 100% remote work setup
  
• Work from anywhere in the Philippines
  
• Direct visibility and collaboration with the
  
• High-impact role with significant technical ownership and autonomy
  
• Opportunity to work on a cloud-native healthcare/SaMD platform
  
• Exposure to modern Azure, AKS, Kubernetes, and cloud security technologies
  
• Opportunity to work in a regulated, high-assurance environment
  
• Collaboration with Engineering, Product, IT, Quality, and Compliance teams