Security & Infrastructure Engineer

Nara is an AI-native benefits administrator (TPA) fixing healthcare benefits by designing and administering personalized, cost-effective health plans for employers, employees, and their families. Our mission is to rebuild health care around people, not the system. We're working toward a future where coverage and care are affordable, accessible, and understandable. To get there, we're rebuilding the system from the ground up, using new data, tools, and technology in service of human judgment, not in place of it.

When we succeed, people get the right care, at an optimal price, without the friction.

We are hiring our first dedicated Security & Infrastructure Engineer, reporting directly to the VP of Engineering. You will own the systems and practices that make our compliance posture and our production platform real: AWS infrastructure, CI/CD, identity, observability, and the day-to-day operations of our security program.

This is a cross-functional role by design. Most of the day-to-day work is platform engineering: writing Terraform, improving deployment and developer experience, standing up observability. Alongside that, you will own our security and compliance operations (Vanta, SOC 2, pen test coordination, access reviews), and provide IT support for a small, primarily non-technical team.

Infrastructure & Platform (40%)

• Design, write, and maintain Terraform for our AWS production environment
• Own and improve our CI/CD pipelines in Git Hub Actions, with an eye toward developer experience and code quality
• Stand up and operate telemetry and observability across production: metrics, logs, traces, and alerting
• Harden production infrastructure: IAM, network segmentation, encryption, and secrets management
• Partner with application engineers on infrastructure design, reviews, and platform improvements

IT & Workplace (40%)

• Own employee onboarding and offboarding: laptop provisioning, identity and SSO, access grants, and MFA setup
• Provide 1:1 IT support for non-technical teammates and administer our endpoint, identity, and MDM stack
• Maintain office network and physical security controls relevant to our HIPAA and SOC 2 obligations

Security & Compliance (20%)

• Own day-to-day operations of our security program, including Vanta evidence collection, control monitoring, and remediation
• Serve as the primary technical point of contact for our SOC 2 Type 2 audit and coordinate annual penetration testing
• Maintain and evolve our security policies and run quarterly access reviews across AWS, production applications, and SaaS tools
• Lead security incident response and contribute to HIPAA compliance operations, including risk assessments and vendor security reviews

• 3-4+ years of experience in infrastructure, platform, Dev Ops, or security engineering, or equivalent demonstrated experience
• Hands-on experience driving or substantially contributing to a SOC 2 Type 2 audit, including evidence collection, control design, auditor coordination, and remediation
• Strong production AWS experience (IAM, VPC, RDS, compute, Cloud Watch, or equivalents)
• Proficiency with Terraform or equivalent infrastructure-as-code
• Experience designing and operating CI/CD pipelines, ideally with Git Hub Actions
• Experience designing and operating telemetry and observability for production systems: metrics, logs, traces, alerting (e.g., Cloud Watch, Datadog, Grafana, Open Telemetry)
• Comfort with core security tooling: SIEM/logging, vulnerability management, IAM/SSO, MFA, and endpoint security
• Strong written communication: policies, runbooks, audit responses, and design docs
• Authorized to work in the United States; we're unable to provide visa sponsorship for this role
• Chicago-based, comfortable with a hybrid schedule