Security & Cloud Operations Engineer

About Candor Health

Candor Health offers a suite of AI-native provider data management solutions that tackle healthcare's data accuracy problem at its core. The result: fragmented, error-prone records become a reliable, continuously verified asset. By synthesizing 120,000+ sources and processing four billion claims monthly, Candor Health strengthens operational workflows around network optimization, credentialing, compliance, and near-real-time provider search.

The result helps health plans, digital health companies, and health systems move from reactive fixes to proactive strategy. Backed by an internal validation team and a genuine client-first partnership model, our solutions turn provider data into a lasting strategic asset that strengthens networks and builds trust.

Life at Candor

At Candor Health, everyone is a leader. The areas you own are yours to build and progress. Best ideas win! We value a culture where the team not only enjoys working together solving some of the biggest data challenges in the healthcare industry, but also has fun doing it. Building a great company is hard work but work-life balance is also important.

About the Role

As a Security & Cloud Operations Engineer, you will help keep Candor's cloud platform secure, reliable, and ready for audit. You will make hands-on infrastructure changes, manage access and security controls, and keep recurring operational and compliance work moving. You should be comfortable investigating a permissions issue, reviewing a Terraform change, and producing clear evidence of how a control works.

You will independently investigate issues, propose practical improvements, and own scoped work through reviewed implementation, validation, and documentation. You will partner with the Security & Ops technical lead, engineering teams, and business control owners. Designated leaders own security architecture and risk acceptance; service teams retain application ownership.

Responsibilities

Cloud Infrastructure & Reliability

• Maintain and improve AWS infrastructure through reviewed Terraform changes. Troubleshoot permissions, resource configuration, and service dependencies, and document changes and recovery steps.
• Support EKS and Kubernetes operations, including node groups, autoscaling, workload disruption controls, and persistent storage. Work with service owners to investigate reliability issues.
• Maintain shared monitoring and logging infrastructure and enable service teams to use it. Review storage usage and cloud costs, automate recurring checks, and recommend practical improvements.

Security Engineering & Access

• Implement least-privilege IAM policies, workload identities, and secure CI authentication. Improve secrets handling and Kubernetes access controls through approved plans and reviews.
• Configure and maintain security controls such as WAF rules and security logging. Investigate findings and propose improvements. Deliver scoped fixes and track remediation through validation with engineering and security partners.
• Handle approved staff and customer access changes, onboarding and offboarding, and recurring access reviews. Keep permissions and completion evidence accurate and current.

Compliance Operations & Readiness

• Maintain Drata records, vendor inventories, control documentation, and supporting evidence. Gather vendor security questionnaires and compliance documents, follow up on gaps, and support SOC 2 audit preparation.
• Maintain practical onboarding and security instructions. Coordinate security training, incident-response exercises, and follow-up actions with the responsible teams.
• Keep incident playbooks and operational runbooks usable and current. Participate in agreed operational coverage, escalate under the incident-response process, and track assigned improvements through closure.

Qualifications

Required

• 3+ years of relevant hands-on experience in security operations, cloud infrastructure, DevOps, or a related engineering role.
• Demonstrated ability to independently own cloud or security operations work from investigation and planning through reviewed implementation, validation, documentation, and follow-through.
• Hands-on experience operating AWS infrastructure and using Terraform to make reviewable, maintainable changes.
• Working experience with Kubernetes or EKS, including identity, permissions, storage, and troubleshooting workload or infrastructure issues.
• Practical understanding of least privilege, IAM, secrets management, logging, and secure deployment workflows. Ability to investigate access problems without defaulting to broad permissions.
• Ability to automate recurring operational tasks with scripts, use version control, and document changes clearly enough for another engineer to support them.
• Experience executing security controls or supporting audit readiness, with careful evidence collection and reliable follow-through on access reviews and remediation.
• Clear communication and sound judgment about change risk, escalation, and when a decision requires a technical lead or business owner.

Preferred

• Experience with Drata or a similar compliance platform, SOC 2 evidence, vendor reviews, or security-awareness programs.
• Experience with Prometheus, Grafana, CloudWatch, WAF, workload identity, or CI/CD authentication improvements.
• Experience improving cloud costs and reliability, maintaining incident playbooks, or supporting tabletop exercises.
• Experience in a SaaS or healthcare-data environment.

How You Work

• Own the follow-through. Keep work organized, close the loop, and communicate progress, dependencies, risks, and decisions early.
• Make careful changes. Prefer scoped access, reviewable infrastructure changes, clear validation, and documented recovery steps.
• Stay practical. Improve the process while doing the detailed work, and build documentation and automation that others can use.