Senior Information Security Engineer

About The Role

We’re looking for a Senior Information Security Engineer to strengthen security across our cloud infrastructure, Microsoft 365 environment, endpoints, and business applications.

This is a hands-on, senior individual contributor role with ownership of security engineering, threat detection, incident response, vulnerability management, and technical controls supporting our SOC 2 Type II and HIPAA compliance objectives.

Reporting to the VP of Technology, you’ll work closely with IT, Engineering, and Compliance to identify risks, implement practical solutions, and verify that security controls work effectively. The initial focus will be approximately 60% security engineering and operations and 40% technical controls, assurance, and audit readiness.

You’ll have the opportunity to shape our security capabilities and turn security requirements into measurable technical improvements.

What You’ll Do

• Design, implement, and maintain security controls across cloud, network, endpoint, identity, and application environments.
• Strengthen Microsoft 365 and Microsoft Entra ID security, including multifactor authentication, Conditional Access, privileged access, and periodic access reviews.
• Investigate security alerts and incidents, perform root-cause analysis, and develop response playbooks and escalation procedures.
• Assess vulnerabilities and security configurations across Windows, macOS, cloud, and virtualized environments, partnering with IT and Engineering to prioritize and verify remediation.
• Improve centralized logging, threat detection, alerting, and log retention to support effective security monitoring and investigations.
• Automate security checks, reporting, investigations, and evidence collection using scripts, APIs, and appropriate security tools.
• Implement, test, and document technical controls supporting SOC 2 Type II and HIPAA requirements, working with Compliance and audit stakeholders.
• Assess security risks involving vendors, SaaS applications, third-party integrations, and AI-enabled systems, including those handling protected health information (PHI).
• Maintain clear incident records, control evidence, and remediation tracking, and communicate security priorities and progress to leadership.

Qualifications

• At least 5 years of hands-on experience in information security engineering, cloud security, security operations, or a related technical security role.
• Demonstrated experience securing Microsoft 365 and Microsoft Entra ID environments.
• Strong understanding of enterprise security architecture, identity management, endpoint protection, and cloud security controls.
• Hands-on experience with endpoint detection and response (EDR), vulnerability management, centralized logging, and security incident investigation.
• Experience implementing and validating technical security controls, with working knowledge of SOC 2 Type II and the HIPAA Security Rule.
• Ability to develop scripts and automation using technologies such as PowerShell, Python, Microsoft Graph, KQL, or equivalent tools.
• Strong troubleshooting, documentation, and risk-prioritization skills.
• Ability to work independently, collaborate across technical and compliance teams, and explain security risks clearly to nontechnical stakeholders.

Preferred Qualifications

• Experience supporting healthcare organizations, healthcare technology companies, or environments that process PHI.
• Experience securing AWS and virtualized infrastructure, including networking, firewall, and backup and recovery controls.
• Familiarity with Microsoft Defender, Sentinel, Purview, or comparable security monitoring, data protection, endpoint management, and compliance automation tools.
• Experience with continuous control monitoring, audit evidence collection, and security integrations through REST APIs.
• Experience assessing security risks in AI-enabled applications, agents, or automated workflows.
• Relevant certifications such as CISSP, CISM, CCSP, CompTIA Security+, or Microsoft security certifications.

Certifications are valued, with demonstrated technical capability and practical experience central to this role.