Location
London, UK (Full-time relocation required; comprehensive visa sponsorship and full relocation support provided)

Hours
Full Time

Salary
Negotiable

About the Role
Flo Health is the world’s #1 health & fitness app focused on female health, with over 500 million downloads and 80 million monthly users. Backed by a $200M investment and valued at $1B in 2024, Flo is building the next generation of AI-powered, privacy-first, clinically backed digital health solutions.

We are seeking a HIPAA Security Engineer to join our Security Architecture team in London. You will lead the design and operation of US Healthcare security controls, working closely with Product and Engineering teams to translate HIPAA and SOC 2 requirements into technical security controls across Flo's AWS multi-account environment, including EKS, Lambda, RDS, S3, VPC networking, IAM, and KMS.

You will own the roadmap for HIPAA compliance and SOC 2 Type II certification, collaborating with external auditors, professional services, Engineering, and Legal to build a secure, compliant platform for millions of users.

Key responsibilities include leading annual SOC 2 and HIPAA certifications, designing technical security controls, defining security policies and risk frameworks, managing vendor risk, automating evidence gathering, serving as the primary Security point of contact for US regulators, and managing GRC and compliance automation platforms.

Flo is a mission-led, product-driven team that values fast, focused ownership, open debate, shared decision-making, and a commitment to delivering better health outcomes.

Experience
- 7+ years in security, compliance, or risk management, including 3+ years in leadership roles
- Deep expertise in SOC 2 and HIPAA frameworks within AWS environments
- Familiarity with PHI handling, GRC and compliance automation platforms
- Exposure to enterprise architecture frameworks such as TOGAF
- Strong ability to manage multiple concurrent audit and certification workstreams
- Excellent written and verbal communication skills, able to translate complex compliance requirements into clear actions

About you
- Proven leadership in compliance and security within regulated industries, preferably healthcare
- Experience working with external auditors and professional services
- Comfortable working in a fast-paced, mission-driven startup environment
- Collaborative mindset with strong stakeholder management skills

Qualifications
- Bachelor's degree in a related field or equivalent experience
- Nice to have: CISA, CISM, or CISSP certifications
- Experience with NIST 800-53, Cloud Security Alliance (CSA), Center for Internet Security (CIS) frameworks
- HITRUST experience is a plus
- Exposure to containerization (Docker/Kubernetes), serverless, big data platforms
- Experience with DevSecOps and Agile development methodologies
- Vendor management experience