Senior​/Security Engineer

Sage is on a mission to improve care and quality of life for older adults, starting with those residing in senior living facilities. Falls are the leading cause of injury-related death among adults over 65. And yet, fall prevention and emergency response systems for older adults are archaic and ineffective. At Sage we've built a more modern way of understanding when older adults need help, including methods for residents to alert caregivers when in need of help, and corresponding software for caregivers to triage response.

Our company mission is to create a product that our client counterparts love, and this role is a key part of that objective.

Sage is a small, tight team of ambitious, multi-disciplinary entrepreneurs. We are a software-enabled, mission-driven company, and are focused only on the problems that are central to achieving that mission. At Sage, we work hard and fast but also know that to build a truly important company, we need to treat our work as a marathon, and not a sprint. The journey matters.

We are looking for a Senior Security Engineer to own and advance the security posture of our platform as we scale. You will be the dedicated security practitioner on the engineering team, responsible for hardening our cloud and edge infrastructure, driving compliance programs, building vulnerability management and incident response capabilities, and embedding security into the software development lifecycle.

This is a hands‑on individual contributor role reporting to the Engineering Manager of Cloud and Security. You will work across AWS and GCP environments, partner closely with product engineering and platform teams, and have direct impact on Sage's ability to earn and maintain customer trust. Success in this role requires deep technical security skills, comfort operating across a broad surface area, and a bias toward practical, risk‑proportionate solutions over checkbox compliance.

• Harden and continuously improve the security of Sage's cloud infrastructure across AWS and GCP, including IAM policies, VPC configurations, security groups, and network segmentation.
• Own vulnerability management end to end: implement scanning, triage findings, coordinate remediation with engineering teams, and track resolution. Drive penetration test findings to closure on defined timelines.
• Build and maintain incident response capabilities, including detection tooling, runbooks, and post‑incident analysis.
• Drive Sage's SOC 2 and HIPAA compliance programs forward, producing evidence, closing control gaps, and coordinating with external auditors.
• Implement and operate supply chain security controls, including dependency scanning, credential leak monitoring, and secret rotation automation.
• Embed security into CI/CD pipelines and the software development lifecycle through automated checks, secure defaults, and developer education.
• Conduct security reviews of architecture decisions, new services, and third‑party integrations. Own the vendor security assessment process for evaluating and tracking third‑party risk.
• Establish and maintain key and credential rotation policies with clear ownership and audit trails.
• Implement automated compliance scanning across cloud accounts and projects with defined triage workflows.
• Validate that disaster recovery procedures maintain security controls through failover, including encryption, access control, and network segmentation.
• Partner with engineering, product, and executive stakeholders to communicate security risk clearly and advocate for proportionate investment.

• 6+ years of experience in security engineering, with demonstrated depth in cloud security (at least one of AWS or GCP required).
• Hands‑on experience with IAM design, VPC architecture, security group management, and infrastructure hardening in production environments.
• Experience building or significantly improving vulnerability management programs, including tooling selection, integration, and triage workflows.
• Direct experience with SOC 2 and HIPAA compliance, including evidence collection, control implementation, and auditor interactions.
• Practical incident response…