Principal Security Manager (India)

Job description

Truveta provides unprecedented real-world data and real-time intelligence, powered by a dataset built with and owned by US health systems united in a mission of Saving Lives with Data. Together, we power breakthrough medical discoveries, accelerate regulatory-grade evidence, and improve patient care. Today, Truveta enables research on more than 130 million de-identified patients across the US. Achieving Truveta’s ambitious mission requires an incredible team of talented and inspired people with a special combination of health, software and big data experience who share our [company values](https://www.truveta.com/careers/). **Role Overview** We are looking for a **Principal Security Engineering Manager** to own and drive security across applications, cloud infrastructure, and platform operations. This role requires a **hands-on technical leader** who can design and implement security controls end-to-end while partnering closely with engineering teams. The ideal candidate brings a strong mix of **software engineering, cloud architecture, and security expertise**, with the ability to scale security practices in a modern, cloud-native environment. **Key Responsibilities** - Lead the design and implementation of **security controls across the full technology stack**, including applications, services, and cloud infrastructure. - Establish and drive **secure development practices**, integrating security into CI/CD pipelines and developer workflows. - Own programs for identifying and addressing risks, including: - Vulnerability discovery and remediation - Application and infrastructure testing - Continuous validation of security posture - Define and implement **data protection strategies**, including encryption, access controls, and data handling standards. - Conduct and govern **security assessments** for both internally developed systems and external vendors/partners. - Build and enhance **identity and access control systems**, ensuring least privilege and strong authentication mechanisms. - Develop and mature **logging, monitoring, and detection capabilities** to identify and respond to threats effectively. - Strengthen **threat detection and incident response readiness** through automation, telemetry, and engineering-driven approaches. - Design and secure **cloud and network architectures**, including edge protection, traffic filtering, and service isolation. - Drive adoption of **modern security architectures** such as zero trust and defense-in-depth. - Integrate **security into emerging technologies**, including AI/ML systems, ensuring protection against data leakage and model abuse. - Partner with engineering, platform, and product teams to **embed security into system design and architecture decisions**. - Lead by example as a **hands-on engineer**, contributing to design reviews, code, and automation where needed. - Mentor and guide engineers, raising the overall **security and engineering maturity** of the organization. **Required Qualifications** - 12–16+ years of experience in **security engineering, software engineering, or cloud security**. - Strong background in **software development or DevOps**, with the ability to build or review code and automation. - Deep understanding of: - Secure application design and common vulnerabilities - Cloud platforms (Azure preferred) and distributed systems - Identity systems and access control models - Monitoring, detection, and response mechanisms - Network and edge security principles - Experience implementing **security at scale in cloud-native environments**. - Proven ability to **balance strategic thinking with hands-on execution**. - Strong communication skills with the ability to influence engineering and leadership teams. **Preferred Qualifications** - Experience in **regulated environments** (e.g., healthcare, finance). - Familiarity with **modern AI/ML security considerations**. - Experience with **large-scale telemetry and detection systems** (e.g., SIEM platforms). - Knowledge of **industry standards and compliance frameworks**. - Relevant certifications (e.g., CISSP, OSCP, cloud security certifications). **What We’re Looking For** - A **builder and problem-solver** who can operate across multiple layers of the stack.