Location
London, UK (Full-time relocation required; comprehensive visa sponsorship and full relocation support provided)

Hours
Full Time

Salary
Negotiable

About the Role
Flo Health is the world’s #1 health & fitness app focused on female health, with over 500 million downloads and 80 million monthly users. Backed by a $200M investment and valued at $1B in 2024, we are building the next generation of AI-powered, privacy-first, clinically backed digital health solutions.

As a HIPAA Security Engineer, you will be a key member of Flo’s Security Architecture team, leading the design and operation of US Healthcare security controls. You will collaborate closely with Product and Engineering teams to translate HIPAA and SOC 2 requirements into technical security controls across Flo’s AWS multi-account environment, including EKS, Lambda, RDS, S3, VPC networking, IAM, and KMS.

You will own the roadmap for HIPAA compliance and SOC 2 Type II certification, working with external auditors and professional services partners, and partnering with Engineering and Legal to build a secure, compliant platform serving millions of users.

This role requires strong leadership in compliance, technical security design, policy and risk management, vendor risk management, operational excellence, stakeholder management, and tooling integration to streamline monitoring and reporting.

Experience
- 7+ years in security, compliance, or risk management, including 3+ years in a leadership capacity
- Deep expertise in SOC 2 and HIPAA frameworks within AWS environments
- Familiarity with PHI handling, GRC and compliance automation platforms
- Exposure to enterprise architecture frameworks such as TOGAF
- Proven ability to manage multiple concurrent audit and certification workstreams
- Excellent written and verbal communication skills to translate complex compliance requirements into clear actions

About you
- Strong leadership and collaboration skills
- Detail-oriented with a proactive approach to compliance and security
- Ability to work effectively with cross-functional teams including Engineering, Legal, and external auditors
- Commitment to building secure, compliant platforms that scale
- Experience in healthcare or regulated industries is a plus

Qualifications
- Bachelor’s degree in a related field or equivalent experience
- Certifications such as CISA, CISM, or CISSP are desirable
- Knowledge of NIST 800-53, Cloud Security Alliance (CSA), and Center for Internet Security (CIS) frameworks is a plus
- Experience with HITRUST, containerization (Docker/Kubernetes), serverless, big data platforms, DevSecOps, Agile development, and vendor management is advantageous