Tech Lead (Senior SWE), Trust Platforms

Tech Lead (Senior SWE), Trust Platforms

About the job

Who we are

Getting benefits shouldn't feel like a part-time job. For too many families, a stack of forms, a wall of deadlines, and one missing document standing between them and help they already qualify for.

Mirza is changing that. We build public benefits infrastructure that matches people to the programs they're eligible for, helps them apply once across programs, and keeps them covered as the rules shift. That's 200+ programs across all 50 states, including Medicaid, SNAP, WIC, and childcare subsidies.

Government agencies, health plans, health systems, employers, community colleges, and unions use Mirza to reach the people they serve. Unfortunately, the stakes are about to get higher. New federal Medicaid requirements take effect January 1, 2027, affecting roughly 20 million adults, and states need a better way to make sure eligible people don't lose coverage over paperwork. We're building exactly that and we would love for you to join us.

About the role

The Tech Lead (Senior SWE), Trust Platforms owns the technical architecture and implementation of Mirza's Trust layer. You'll be the primary technical counterpart to our Trust Product Manager, who owns the compliance program and requirements, and you'll turn those requirements into durable systems spanning identity and access, environment isolation, auditability, compliance evidence, secure delivery, threat modeling, and incident readiness. Mirza already operates in SOC 2 Type II and HIPAA-compliant environments, so you're not starting from scratch. The job is making trust a property of the platform instead of a pile of manual processes, and laying the technical groundwork for NIST 800-series alignment. This is an engineering role, not a policy, GRC, review-only, or people-manager-first role. You'll write production code.

What you’ll do

• Own the technical architecture for the systems and controls behind Mirza's security, privacy, and compliance posture.

• Design and build identity, authentication, authorization, and least-privilege access models, and strengthen isolation between environments, tenants, workloads, and sensitive data.

• Build durable audit logging, change history, and evidence generation, along with secure release, deployment, and production-access controls.

• Partner with the Trust Product Manager to turn regulatory, customer, and audit requirements into technical designs, and decide whether each should be enforced through architecture, infrastructure, application logic, automation, or process.

• Work across engineering teams so trust requirements are built into system design instead of bolted on afterward, and create reusable patterns that let other teams build securely by default.

• Maintain and strengthen the technical controls behind our SOC 2 Type II and HIPAA compliance, automating control monitoring, evidence, and access reviews wherever software beats a manual process.

• Support audits, evidence requests, and testing, and own engineering remediation for technical findings through to closure.

• Translate NIST 800-series requirements into architecture and implementation priorities, help Mirza move toward FedRAMP-aligned practices where appropriate, and decide what to build now versus design for later without adding needless complexity.

• Lead practical threat modeling across critical systems, identifying trust boundaries, attack surfaces, privilege-escalation paths, and data exposure, and turn what you find into concrete controls.

• Review new architectures and high-risk changes before they reach production, without turning security review into a bottleneck.

• Own the engineering side of incident readiness, including logging, detection, investigation and containment capabilities, runbooks, and tabletop exercises, and lead technical response when incidents happen.

• Stay deeply hands-on: write production code and infrastructure, implement critical controls yourself, build internal tooling, debug production issues, and review security-sensitive changes.

• Make clear tradeoffs across security, developer experience, reliability, scalability, compliance, and delivery speed.

• What we’re looking for

• 7+ years of software engineering experience, with real senior engineer or tech lead responsibility in production environments.

• A track record of personally designing, building, and operating security-sensitive systems, not just managing the teams that did.

• Hands-on experience implementing and operating technical controls for SOC 2 Type II, and building or running HIPAA-compliant systems.

• Strong cloud-native infrastructure experience, ideally AWS.

• Deep practical experience with identity and access management, authorization models, secrets management, audit logging, monitoring, and production access controls.

• Experience with infrastructure as code, CI/CD, secure software delivery, and environment management.

• Proven ability to run security architecture reviews and threat modeling, and turn identified risks into practical controls.

• Experience owning technical remediation from security testing, audit findings, incidents, or control gaps through completion.

• Strong understanding of distributed systems, APIs, data flows, and service boundaries, and the ability to write high-quality production code.

• Strong technical judgment and the ability to explain tradeoffs clearly to product leaders, engineers, auditors, and senior leadership.

• Comfort working autonomously while both the architecture and the operating model are still maturing.

• Experience building software in regulated or high-trust environments like government, healthcare, fintech, or enterprise security (strongly preferred).

• Experience with NIST 800-series, FedRAMP, or relevant ISO frameworks.

• We aren't expecting you to be an expert in everything described above. If you check most of the boxes, and are ready to roll up your sleeves and learn, we’d love to hear from you.

What We Offer

• $170,000-$190,000 base salary
• Stock options
• Healthcare, Dental, Vision, Life
• 401k with company contribution
• 16 weeks of fully paid parental leave for birthing and non-birthing + optional 8 week ramp-up period at 80% pay
• Fully remote and flexible hours
• Plus more!

About the company

Hey Mirza

Actively Hiring More jobs Financial Planning & Childcare Funding for Working Parents11-50 Employees

New York City

11-50

Families

Parenting

Career Planning

Fin Tech