Staff Security & Platform Engineer

About BIOS Life

BIOS Life is a Boston-based, venture-backed healthcare technology company on a mission to fundamentally change how cancer is detected, monitored, and managed. We’re building a new model of proactive, personalized cancer care that combines advanced AI, real-world clinical data, and evidence-based medicine to help patients and clinicians make better decisions throughout the cancer journey.

Our platform brings together longitudinal patient data, predictive risk models, clinical decision support, and virtual care delivery to enable more personalized cancer screening, surveillance, and survivorship care. We’re building both the technology and clinical infrastructure to make this approach scalable, accessible, and integrated into patients’ lives.

We’re an early-stage company with an ambitious mission and a collaborative, multidisciplinary team spanning engineering, AI, clinical care, and operations. We’re looking for people who are excited to build something meaningful, solve complex problems, and help shape the future of cancer care.

The Role

We’re looking for a hands-on Staff Security & Platform Engineer to own and evolve the cloud infrastructure, platform engineering, and technical security foundations that support BIOS.

You’ll be the primary technical owner of our AWS and GCP environments, working across cloud architecture, infrastructure automation, DevSecOps, observability, reliability, and security operations. You’ll also serve as the technical counterpart to our managed IT, SOC 2 compliance, and Quality/Regulatory partners.

As an early-stage company, we’re looking for someone who thrives in a dynamic, collaborative environment, enjoys solving problems across disciplines, and is comfortable adapting as the company grows. You’ll work closely with Product Engineering, AI, and other teams to build secure, scalable infrastructure supporting our clinical applications, data platforms, and AI capabilities.

This is a highly collaborative, hybrid role based in our Cambridge office, with a minimum of three days per week onsite. We value working together in person to solve problems, share knowledge, and build strong relationships across our Engineering and AI teams. You’ll have the opportunity to shape our technical foundations, influence how we work, and contribute directly to BIOS’s mission and engineering culture as we scale.

Our goal isn’t to create an infrastructure gatekeeper. It’s to build secure, reliable, self-service infrastructure—through automation, reusable patterns, and sensible guardrails—that enables engineering teams to move quickly without compromising security or operational discipline.

What You Will Own

Cloud Infrastructure & Platform Engineering

• Own the architecture, security, and operational management of BIOS AWS and GCP environments, including IAM, networking, secrets management, and cross-cloud infrastructure.
• Establish and expand Infrastructure as Code (Terraform or equivalent), automation, and reusable platform patterns that make infrastructure secure, reproducible, and easy for engineering teams to use.
• Establish best practices for provisioning, securing, monitoring, and managing cloud compute resources, including VMs, GPU/TPU infrastructure, and AI/ML workloads in GCP.
• Partner with Engineering and AI teams on infrastructure architecture for clinical, data, and AI workloads, including the design and implementation of a Trusted Research Environment (TRE).
• Drive infrastructure efficiency and cost optimization through resource monitoring, cost visibility, and appropriate operational controls.

CI/CD, Developer Infrastructure & DevSecOps

• Own and evolve CI/CD infrastructure and deployment mechanisms, enabling engineering teams to build, test, deploy, and roll back applications safely and independently.
• Manage GitHub organization-level security and administration, including access controls, Actions/runners, secrets, branch protections, and security integrations.
• Integrate code, dependency, container, and infrastructure security scanning into engineering workflows.
• Establish platform-level production readiness standards and deployment guardrails while Engineering retains ownership of application development practices and service releases.

Reliability, Observability & Disaster Recovery

• Own infrastructure observability, including logging, metrics, tracing, alerting, and operational visibility across BIOS environments.
• Establish monitoring standards, dashboards, and operational practices that improve platform reliability, performance, and incident investigation.
• Own infrastructure backup, disaster recovery, and business continuity capabilities, including recovery objectives (RTO/RPO), runbooks, and periodic recovery testing.
• Partner with Engineering teams to improve operational readiness and resilience as the platform scales.

Security Operations & Vulnerability Management

• Maintain cloud and infrastructure security posture, proactively identifying configuration risks, vulnerabilities, and security gaps and driving remediation.
• Own technical vulnerability management and coordinate penetration testing, security assessments, and remediation tracking in partnership with Engineering and external specialists.
• Lead infrastructure and cloud-security incident preparedness and response, including investigation, containment, recovery, and post-incident improvements.
• Partner with Engineering and AI teams on threat modeling and security architecture for new platform capabilities, including mobile, web, and AI applications.

Compliance Engineering & Audit Readiness

• Implement and maintain technical security and infrastructure controls supporting SOC 2 and other applicable regulatory and compliance requirements.
• Maintain integrations with Vanta and other assurance tools, automating technical evidence collection wherever practical.
• Partner with compliance and Quality/Regulatory leadership on audit readiness and infrastructure requirements related to the Quality Management System (QMS).
• Maintain clear architecture, security, and operational documentation to support auditability, knowledge sharing, and sustainable platform operations.

What We’re Looking For

Required

• Significant hands-on experience designing, operating, and securing production cloud infrastructure, with strong AWS experience and meaningful GCP experience (or deep expertise in one and demonstrated ability to work across both).
• Strong understanding of cloud IAM, service accounts, privileged access, networking, encryption, and secrets management.
• Strong Infrastructure as Code experience, preferably with Terraform, and the ability to build automation and tooling using scripting or programming languages.
• Experience designing and operating CI/CD systems, production deployment infrastructure, and GitHub organization-level administration, including Actions and security controls.
• Solid Linux, networking, and cloud infrastructure fundamentals.
• Experience with observability, production operations, incident response, and backup/recovery.
• Experience with cloud and infrastructure vulnerability management, security assessments, and operational security practices.
• Staff-level technical judgment: Ability to make architectural tradeoffs, work autonomously, influence engineering practices, and communicate technical risks clearly to engineering teams and business leadership.
• Collaborative and team-oriented: Enjoys working closely with engineers and cross-functional partners, sharing knowledge, learning from others, and solving problems together. Values in-person collaboration and contributing to a strong engineering culture.
• Adaptable and entrepreneurial: Thrives in an early-stage startup environment, embraces ambiguity, and is comfortable wearing multiple hats, balancing immediate needs with long-term architecture, and adjusting priorities as the company evolves.

Strongly Preferred

• Experience operating infrastructure in healthcare, life sciences, fintech, or another regulated or high-assurance environment.
• Experience supporting SOC 2 or similar security audits, including compliance automation platforms such as Vanta.
• Experience coordinating independent penetration tests and security assessments.
• Experience with containerized workloads and orchestration platforms such as Kubernetes (GKE/EKS), including security, deployment, and operational practices.
• Experience building internal developer platforms, reusable infrastructure components, or self-service deployment capabilities.
• Experience operating multi-cloud environments and infrastructure supporting sensitive clinical, research, or regulated data.
• Familiarity with GPU/TPU infrastructure, AI/ML workloads, or secure research computing environments.
• Familiarity with regulated software development or Quality Management Systems (QMS).

What Success Looks Like

A successful Staff Security & Platform Engineer will progressively make the BIOS platform:

• More automated and reproducible, with infrastructure managed through code rather than manual configuration.
• Easier for engineering teams to use, with secure, self-service deployment and infrastructure capabilities.
• More observable and reliable, with clear operational visibility and actionable monitoring.
• More resilient, with tested recovery procedures and well-defined operational practices.
• More secure and auditable, with effective technical controls, vulnerability management, and automated compliance evidence.
• More efficient, with appropriate resource utilization, cost visibility, and scalable infrastructure patterns.
• More collaborative and empowering, with Engineering and AI teams working effectively together, sharing operational knowledge, and independently operating within clear infrastructure and security guardrails.
• Less dependent on individuals, through documentation, automation, and shared operational knowledge.

The strongest signal of success isn’t that this person personally performs every operational task. It’s that the platform becomes safer, more predictable, more self-service, and easier for engineering teams to operate within clear guardrails.