Senior / Staff Platform Security Engineer

This is a remote position Join one of the Philippines' fastest-growing tech companies! Open to Philippine-based candidates only. About Us Full Scale is a remote-first company that helps businesses build dedicated teams of skilled software engineers. We make it easier for growing companies to find, onboard, and keep high-performing software talent. About the Role You'll join a fast-growing US healthcare SaaS company as its senior security engineer and the go-to owner of technical security. Its Azure-based medical imaging platform is used by more than 3,000 healthcare practices. The platform stores protected health information (PHI) and connects to more than 50 hardware systems, more than 30 practice-management and EHR systems, and several AI partners. The engineering team has about 20 people and expects to double within a year. Security is currently owned by the CTO, and this role takes it over. There's no security architect above this role. You'll design the security architecture, decide what matters most, build and validate the controls yourself, and represent security to engineers, leadership, partners, customers, and auditors. The company has a compliance team. This role is not a compliance, audit, analyst, or DevOps position. What You'll Own Security architecture and roadmap: Within your first 30-60 days, assess the platform, find the risks yourself, and present a prioritized security roadmap. Then design and carry out the fixes. External credibility: Be the company's technical security voice with partner compliance and security teams, customer security reviews and questionnaires, and external auditors. When you speak on security, your word needs to carry weight. Secure development under a regulated medical-device process (ISO 13485): Lead security in design reviews at every stage: security requirements during planning, owning and updating threat models during design, checking that controls are built as designed, verification and validation, release review, and monitoring after release. Platform security: Design and harden the production path: Azure Front Door and WAF, API gateway, NGINX ingress, multi-cluster AKS (1,000+ pods), Azure SQL, and Blob Storage. Application security with engineers: Work directly with software engineers to improve application and API security, including authorization design and tenant isolation in a platform where each tenant has dedicated resources. Partner and integration security: Secure partner APIs and third-party access, give each vendor only the data and endpoints it needs, and lead the technical response when a partner has an incident. Vulnerability management: Own triage of findings from the security scanning tools (Aikido, Probly), set the timeframes for fixes, and make sure engineering meets them. Identity and access: Set and enforce policy for Entra ID, role-based access, privileged identity management (PIM), just-in-time access, and user lifecycle, working with the IT manager. Detection and incident response: Build monitoring and alerting, investigate unusual activity, and lead containment, breach assessment, and communication with stakeholders. Compliance support: Work with the security and privacy compliance manager to implement and test controls and produce evidence for SOC 2, HIPAA, and ISO 27001 (Vanta). Requirements 6+ years in technical infrastructure or security roles, including + years in security engineering. A current or recent Senior, Staff, Lead, or Principal title in a role such as Cloud Security Engineer, Security Engineer, Platform Security Engineer, Infrastructure Security Engineer, Cybersecurity Engineer, or Security Architect. A background in DevOps or SRE is fine, but your most recent work should be security engineering. Candidates whose recent experience is mainly DevOps or DevSecOps pipeline work, SOC or security analysis, or compliance won't be a strong fit. You've designed and built cloud security architecture, not only operated infrastructure someone else designed. You've owned security without someone above you directing it. You've independently found risks, worked out how to fix them, and driven the fixes through engineering teams, without a security architect or manager setting the direction. You've owned meaningful responsibility in at least most of these areas: application security, identity and access, network security, vulnerability management, and incident response. Confident, direct communication. You can push back on engineers and leadership when it's warranted, explain risk in business terms, and hold your ground with partner security teams, customer compliance teams, and auditors. Hands-on Azure security: Entra ID, managed and workload identities, RBAC, PIM, Key Vault, Defender for Cloud, Sentinel or similar, private endpoints, and least-privilege design. AKS and Kubernetes security: Kubernetes RBAC, workload identity, secrets, network policies, pod security, admission and policy controls, ingress controls, runtime protection, and workload isolation. Application and API security: authentication and authorization design, object-level permission flaws (BOLA/IDOR), multi-tenant isolation, rate limiting, and API key management. Secure development tooling and supply chain: SAST, DAST, dependency scanning (SCA), secret scanning, infrastructure-as-code and container scanning, CVE/CVSS triage, CI/CD security gates, image signing and provenance, and container registries. Network security: WAFs, firewalls, segmentation, private endpoints, inbound and outbound traffic controls, reducing attack surface, and zero-trust principles. Detection and incident response: SIEM telemetry, identity events, cloud audit logs, writing detections, investigation, containment, and rotating or revoking credentials. Infrastructure as code with Terraform, Bicep, or ARM, including policy-as-code (Azure Policy, OPA/Gatekeeper, or similar). Still hands-on at the keyboard. You should be able to describe controls you personally designed and configured: the tools, the design decisions, the problems you hit, and how you validated the control. Preferred Healthcare SaaS, medical-device or FDA-regulated software, fintech, or another high-assurance environment. Experience representing security in customer security reviews, partner due diligence, or external audits (HIPAA, SOC 2, ISO 27001, or ISO 13485). Microsoft Defender for Cloud, Sentinel, Azure Policy, Log Analytics, CrowdStrike, Aikido, Vanta, or New Relic. GitHub Actions or Azure DevOps. SAML, OIDC, SCIM, SSO, MFA, and Conditional Access. .NET, Angular, or security automation in Python, Go, Bash, or PowerShell. Certifications such as Azure Security Engineer Associate, CKS, CCSP, or CISSP, backed by hands-on implementation experience. Benefits Why join us: 100% remote work setup Work from anywhere in the Philippines Direct visibility and collaboration with the High-impact role with significant technical ownership and autonomy Opportunity to work on a cloud-native healthcare/SaMD platform Exposure to modern Azure, AKS, Kubernetes, and cloud security technologies Opportunity to work in a regulated, high-assurance environment Collaboration with Engineering, Product, IT, Quality, and Compliance teams