DevOps & Security Engineer - AI-Native Healthcare SaaS
Zenara Health
IndiaremotePosted 1 month ago
Z
Skill Required
DevOpsDevSecOpsSecurity-EngineeringSite-Reliability-EngineeringPlatform-EngineeringCloud-SecurityInfrastructure-EngineeringHealthcare-IT-SecurityAI-InfrastructureCompliance-EngineeringHealthcare-ComplianceSecurity-DevOps-EngineerDevOps-Security-EngineerSecure-DevOps-EngineerCloud-Native-Security-EngineerSenior-DevOps-Engineer-AI-MLAI EngineerDevOps EngineerSecurity EngineersecurityAIBackup and RecoverySOCCybersecurityCD pipelinesWeb AccessibilityEngineeringautomationdevelopingObservabilityCryptographybuildingAzuredesignISO 27001CI/CDCloudAWSandGoCICDFulltime
Key highlights
- Salary: ₹22–35 LPA
- Required experience: 5–10 years in DevOps, SRE, or Platform Engineering
- Fully remote work options available throughout India
- Evening IST schedule with 4–8 hours daily overlap with US Pacific (9am–5pm PT)
- Direct access to the CEO without intermediaries
- HIPAA-regulated healthcare environment with SOC 2 Type II preparation underway
Role overview
Zenara Health is a mental healthcare startup that integrates AI-driven platforms with professional clinical care to deliver personalized mental health solutions. The platform manages clinical data, operates AI workflows, and processes insurance billing within a HIPAA-regulated environment serving real psychiatric practices. Zenara has operational infrastructure but lacks dedicated CI/CD ownership, a comprehensive security posture, and monitoring beyond simple uptime checks. This role owns Zenara's infrastructure, security posture, and compliance engineering — from the ground up. It is a dual-mandate position responsible for both ensuring the stability and security of the existing platform and building the necessary infrastructure for AI at scale, within a healthcare company with genuine compliance obligations and real users.
Responsibilities
- Manage threat modeling, reduce attack surfaces, oversee intrusion detection, handle vulnerability management, and plan incident responses
- Serve as the final reviewer for infrastructure and security risks, possessing the authority to halt releases that do not satisfy security or compliance criteria
- Design and implement CI/CD pipelines for all Zenara products, establishing deployment automation, managing environments, and setting quality thresholds
- Eliminate chaotic releases and establish a system that enables the team to deploy confidently and consistently without compromising security
- Develop and uphold a HIPAA-compliant security posture across all Zenara systems
- Implement access controls, manage secrets, maintain audit logs, and enforce encryption standards
- Ensure adherence to regulatory requirements while avoiding bureaucratic slowdowns
- Create monitoring and alerting capabilities to proactively identify issues before they affect users
- Establish incident response protocols, define service level objectives (SLOs), and monitor reliability metrics
- Lead the on-call rotation and develop runbooks for common incidents
- Address AI infrastructure needs including model serving, GPU provisioning (if necessary), and autoscaling for AI workloads
- Collaborate with the Head of AI to ensure infrastructure supports production AI efficiently and securely
- Oversee cloud infrastructure (AWS/Azure), focusing on cost optimization, reliability, disaster recovery, and capacity planning
- Make architectural decisions that balance cost, performance, and compliance obligations
- Spearhead SOC 2 Type II preparedness as the company approaches fundraising, implementing necessary controls, organizing evidence collection, and liaising with auditors
- Ensure compliance becomes an integrated process rather than an ad-hoc measure
- Take charge of security incident response, establishing procedures, conducting regular security evaluations, and responding to incidents as they arise
- Help the organization recognize security as an essential discipline rather than an afterthought
- Devise systems from fundamental principles, make architectural choices, and establish best practices to guide the company through growth and compliance audits
- Serve as the ultimate security gatekeeper
Requirements
- 5-10 years of experience in DevOps, SRE, or Platform Engineering — designed and maintained large-scale production infrastructure
- Strong security mindset: naturally cautious, detail-focused, and able to express concerns when risks are too high; views security as a fundamental necessity, not merely a feature
- Familiarity with HIPAA, SOC 2, or healthcare compliance frameworks — understands BAAs, audit trails, and regulatory obligations, and has successfully implemented compliant systems
- Proficient in AWS or Azure with infrastructure-as-code (Terraform, Pulumi, or CloudFormation) — handles infrastructure through programming rather than manual console operations
- CI/CD pipeline design and implementation experience (GitHub Actions, CircleCI, Jenkins, or similar) — has developed deployment automation from the ground up
- Experience in container orchestration (Kubernetes, ECS, or equivalent) — knows how to deploy and scale applications in containers
- Skills in cybersecurity: threat modeling, vulnerability assessment, intrusion detection, and incident response
- Strong English communication skills — operates asynchronously and provides clear written documentation, incident reports, and architectural designs
- Experience in startup or high-growth environments — has thrived in situations marked by uncertainty, constrained resources, and pressing deadlines
Nice to have
- Experience in supporting ML/AI infrastructure (model serving, GPU clusters)
- Security expertise in healthcare SaaS (handling PHI, encryption at rest/transit, access auditing)
- Background in penetration testing or security audits
- Prior experience with SOC 2 or HITRUST certification processes
- Knowledge of observability and monitoring tools (Datadog, Prometheus, Grafana, or similar)
- Understanding of FHIR/HL7 healthcare data standards
- Production experience with Kubernetes
- Acquainted with multi-tenant SaaS security strategies
- Exposure to mental health or behavioral health sectors
- Experience with cloud infrastructure cost optimization
- Relevant security certifications (CISSP, CEH, or equivalent)
Benefits
- Salary between ₹22–35 LPA, based on skills and responsibilities
- Fully remote work options available throughout India
- Provision for equipment allowance
- Acknowledgment of culturally significant local holidays (India)
- Flexible paid leave options
- Direct and regular communication with the CEO — direct access without any intermediaries
- Opportunity to build infrastructure and security practices from the ground up
Additional details
- Zenara Health is a mental healthcare organization driven by technology, aiming to improve accessibility and quality of mental wellness services by integrating AI-driven platforms with professional clinical care
- This position serves as the company's foremost line of defense
- You will operate under the assumption that systems are constantly under threat, crafting infrastructure that is resilient, auditable, and inherently secure
- You will be the most risk-aware individual in the startup
- While others concentrate on feature rollout, you will prioritize security of patient data, regulatory compliance, and system integrity
- If your understanding of DevOps is limited to 'I occasionally execute kubectl apply,' this position is likely not for you
- This role is not suited for those who prioritize speed over safety or view security as an afterthought
- At Zenara, safeguarding patient data and maintaining system integrity takes precedence over rapid deployment
- The infrastructure is operational but currently lacks a dedicated CI/CD owner, a comprehensive security posture, and monitoring beyond simple uptime checks
- If HIPAA auditors were to arrive tomorrow, the company could withstand scrutiny but it wouldn't be a pleasant experience
- Your role goes beyond mere maintenance — you will develop infrastructure for the AI platform
- This represents a unique opportunity for greenfield infrastructure engineering within a healthcare AI company with genuine compliance obligations and real users
- You will have the authority to assertively say no when risks are unacceptable
- Schedule: Evening IST hours with 4–8 hours of daily overlap with US Pacific (9am–5pm PT); welcome to propose a schedule that works best
- Emphasis is on overlap and team availability rather than rigid clock-in requirements
- On-call availability is expected during key security incidents
- Originally posted on Himalayas