GCP DevOps & Cloud Security Engineer Needed for Kubernetes / GKE Healthcare Platform

We are looking for an experienced "DevOps and Cloud Security Engineer" to review, harden, and improve the security posture of a healthcare SaaS platform running on Google Cloud and Kubernetes. The platform uses Kubernetes/GKE workloads, Google Cloud networking, Cloud SQL, Secret Manager, Cloud KMS, Cloud Storage, Terraform, and Cloudflare edge services. We need someone who can assess the current architecture, identify security gaps, and implement improvements aligned with SOC 2 readiness and HIPAA security best practices. **Responsibilities:** - Review the existing GCP and Kubernetes architecture for security, networking, IAM, and compliance gaps - Harden Kubernetes workloads, ingress, namespaces, service accounts, RBAC, network policies, and deployment configurations - Review and improve workload identity, secret access, and least-privilege permissions - Configure or improve private database connectivity, preferably using Private Service Connect where applicable - Review Cloud SQL security settings, TLS enforcement, backup, PITR, deletion protection, and access controls - Implement or improve Cloud KMS / CMEK encryption for supported services - Review Cloudflare setup including WAF, rate limiting, tunnels, protected internal access, and edge routing - Improve logging, monitoring, alerting, audit trails, and Security Command Center visibility - Map technical controls to SOC 2 and HIPAA-aligned safeguards - Manage infrastructure changes through Terraform with proper documentation and changelog - Provide a clear gap assessment, remediation plan, and final handover documentation **Required Experience:** - Strong hands-on experience with Google Cloud Platform - Kubernetes / GKE, ingress controllers, RBAC, service accounts, secrets, network policies, and workload security - Cloud SQL, Shared VPC, IAM, Secret Manager, Cloud KMS, Cloud Storage - Terraform / Infrastructure as Code - Cloudflare WAF, Access, Tunnel, DNS, or edge security experience - Security hardening for production SaaS environments - SOC 2 readiness, HIPAA-aligned controls, or cloud compliance experience - Logging, monitoring, alerting, audit logs, and Security Command Center - Ability to document findings clearly and prioritize remediation work Nice to Have: - Healthcare SaaS or sensitive-data platform experience - Private Service Connect experience - Experience replacing broad IAM roles with custom least-privilege roles - Experience securing Kubernetes clusters and multi-service environments - Experience preparing evidence for SOC 2 audits - Experience with incident prevention, backup validation, and recovery controls **Deliverables:** - Current-state DevOps, cloud security, and compliance gap assessment - Prioritized remediation roadmap: Critical / High / Medium - Terraform-based implementation of approved infrastructure and security improvements - Kubernetes RBAC, secrets, ingress, and workload security review - IAM and secrets access model documentation - Logging, alerting, and audit evidence checklist - Final architecture and handover documentation Ideal Candidate: You should be practical, security-focused, and comfortable working with existing production infrastructure. We are not looking for generic advice only. We need someone who can review the real environment, identify what matters, and implement secure, maintainable improvements without disrupting production.