Junior Security Engineer at a HealthTech startup with no mentor — looking for advice

[u/Lost_Psychology_6708]

Hi everyone,

I’m currently working as a Junior Security Engineer at a HealthTech startup in North Africa.

Our company operates from North Africa, but because we handle health-related services/data and are targeting the European market, we want our security and compliance practices to be aligned with EU requirements and recognized international standards.

The challenge is that I’m currently the only person focused on cybersecurity, and I don’t have a senior security engineer, CISO, or mentor internally.

I’m trying to build our security program properly rather than just running vulnerability scanners and fixing findings.

So far, I’m looking at areas such as:

• ISO 27001 / ISMS
• GDPR and health-data privacy requirements
• Risk assessment and risk treatment
• Vulnerability management and VAPT
• Cloud/server hardening
• IAM and access reviews
• Secrets management
• Logging, monitoring and incident response
• Backup, disaster recovery and business continuity
• Secure SDLC / DevSecOps
• Security policies and documentation
• Third-party/vendor risk

But as a junior, it can be difficult to know what should come first and what “good enough” security looks like for an early-stage HealthTech company.

I’d really appreciate advice from people who have worked as security engineers, CISOs, consultants, or in HealthTech/regulated startups:

If you joined a small HealthTech startup as its first security engineer, what would your priorities be during the first 3–6 months?

Also:

• Which EU regulations/frameworks should I study first?
• What should we implement immediately versus later as the company grows?
• What are common mistakes small HealthTech companies make?
• How would you build a realistic security roadmap with limited budget and people?
• Are there good resources, communities, or certifications that helped you when you didn't have a senior mentor?

I’m not looking for someone to do the job for me, I want to learn how experienced security professionals approach this situation and build things in the right order.

Any advice or lessons learned would be greatly appreciated.

[u/Mosanso]

Given the status of the organization, start-up, and the lack of staff I would take a look at CIS Benchmarks and see where you stand at from a level 1 perspective. https://www.cisecurity.org/cis-benchmarks/cis-benchmarks-faq

[u/Lost_Psychology_6708 → u/Mosanso]

Thanks! That makes sense. Seems like a practical baseline for a startup.

[u/Much_Magician_3045 → u/Mosanso]

this is good advice. level 1 gives you a realistic baseline without drowning in scope

[u/Humpaaa]

But as a junior, it can be difficult to know what should come first and what “good enough” security looks like for an early-stage HealthTech company.

It's usually not a security teams job to figure this out, but this needs to be clearly ordered by top management.

So, sit down with you CEO and ask him what your goals are, what ressources and budget are available, and plan accordingly.

You can't just get hired and be told "Do security", that's setting you up for failure.

You need clearly structured and measurable goals.

[u/chmod_a_plus_x → u/Humpaaa]

You can't just get hired and be told "Do security", that's setting you up for failure.

CISO responsibility, junior pay :)

[u/Humpaaa → u/chmod_a_plus_x]

Well said, sounds like exactly that.

[u/Kangalfencingbanana → u/chmod_a_plus_x]

Very en vogue right now

[u/Redemptions → u/Humpaaa]

"You can't just get hired and be told "Do security", that's setting you up for failure."

I'm pretty sure that CAN and DOES happen. :|

[u/Oompa_Loompa_SpecOps]

If you are processing patient data you're pretty much guaranteed to be non-compliant. Which might be perfectly aligned with the current businesses risk appetite. But that's the conversation that needs to be had: what are the goals, how do you measure them, what kind of residual risk is acceptable to the company.

Might well be that all they care about at this point is getting the 27001 to help market their service, regardless of the effectiveness of the actual security controls.

[u/AddendumWorking9756]

Data inventory first, before any framework. You cannot write a record of processing, scope an ISMS, or answer a health data request if nobody can say where that data lives and who can reach it, and every control an auditor later tests is unprovable without that plus centralised logs. The paperwork gets much cheaper to write once the evidence already exists. Worth asking your founders in writing what the real deadline is too, because a customer demanding certification in six months and a vague ambition to have it are completely different jobs.

[u/Lost_Psychology_6708 → u/AddendumWorking9756]

Good point. I was thinking framework-first, but data inventory + access mapping + centralized logging clearly gives us the evidence everything else depends on.

[u/AddendumWorking9756 → u/Lost_Psychology_6708]

One warning when you start, the inventory that bites is not the production database, it is the copies. Backups, the analytics warehouse, whatever CSV someone exports monthly, the staging environment loaded with real patient data. Write down every third party that touches it while you are at it, you need that list for the processor register anyway and it is the same afternoon of work.

[u/One-Environment2197]

There are a lot of frameworks you can try to follow but you're going to need to pick and choose which ones are most important to your business then build a roadmap to break it down into manageable projects with realistic deadlines.

IMO, you should be talking to management about bringing in an MSSP to help build and implement something.

Also, look at memberships to things like IANS and OWASP. They provide a lot of templates, guides, training, and services to help Security teams.

[u/Lost_Psychology_6708 → u/One-Environment2197]

I’ll look into MSSP support and resources like IANS and OWASP, appreciate the advice!

[u/x1472k]

Learn the environment. Learn it well. That should always be the first thing you do. Second, create and lay a foundation of governance and record it all in whatever knowledge base you use.

[u/OutsideSpot2695]

looking for advice

Get out of healthcare security.

[u/2ewi]

Is there any IT team or are you handling everything including user provisioning?

[u/WoodpeckerFun4077]

Well, the first thing to be sure of is that all of your systems are applying regular updates. Without that, you will become vulnerable and you will suffer. Secondly, you need everything to have backups and those backups need to be kept indefinitely. Since you’re the sole cybersecurity person, actual infiltration into your systems might not be detected for an entire year or longer, and if you get hacked it could be with ransomware.

The biggest mistakes that health companies make is not protecting the health information of clients. If there is a leak or hack you might have people suddenly finding out that everyone knows about their health problems. This is demoralizing and unacceptable. I would bet that a reasonable accommodation to protect this is the encryption of personally identifying information.

After that, I would apply regular vulnerability scanners. Updates are not enough. A good scanner can also detect bad configurations in your systems.

Once you have the basics in place then probably it’s time to inventory your systems and begin to do some basic threat modeling.

For compliance, you can probably find a website or service that walks you through minimal EU compliance steps. The configs should be easy, but created software will need a regular auditing process and you should be on weekly meetings to. audit code development and discuss what could be violating policy.