IT Security Engineer
Remote
Full Time
Experienced
We are hiring in the following States:
AZ, CA, CO, CT, FL, GA, HI, IL, MA, ME, MN, MO, NC, NJ, NV, OK, PA, SD, TN, TX, VA, WA
This is a remote position. Candidates who meet the minimum qualifications will be required to complete a video prescreen to move forward in the hiring process.
Salary Range: $115,000 to $140,000 a year
Benefits: PTO, 401K, medical, dental, vision, life insurance, paid holidays, and more
AZ, CA, CO, CT, FL, GA, HI, IL, MA, ME, MN, MO, NC, NJ, NV, OK, PA, SD, TN, TX, VA, WA
This is a remote position. Candidates who meet the minimum qualifications will be required to complete a video prescreen to move forward in the hiring process.
Salary Range: $115,000 to $140,000 a year
Benefits: PTO, 401K, medical, dental, vision, life insurance, paid holidays, and more
Job Overview
Responsible for security design, engineering, implementation, and proactive/reactive monitoring and security-level support of all platforms at Currance. Includes adhering to and helping to maintain the Security Program and associated policies, managing a Security Awareness program, building digital security protocols, operating IT and cyber security systems, and maintaining the security related health and configurations of all infrastructure.
Job Duties and Responsibilities
- Identify and resolve vulnerabilities across on-premises and cloud-based networks, applications, and systems, with a focus on Azure Security Center.
- Monitor both on-premises and cloud-based networks and systems for security threats or breaches using Barracuda, Azure Sentinel, and other cloud security tools.
- Respond to cloud and on-premises security incidents by investigating alerts, identifying breaches, and taking immediate action to contain and mitigate potential damages.
- Implement risk mitigation strategies tailored for hybrid and multi-cloud environments to reduce the impact of potential breaches.
- Perform root cause analysis for incidents in both on-premises and cloud environments, refining security protocols and controls based on lessons learned.
- Conduct regular security audits and vulnerability assessments in cloud environments to assess risks and strengthen cloud defense mechanisms.
- Implement and maintain a vulnerability management program that includes timely patches and updates for both cloud and on-premises systems.
- Develop and maintain cloud-focused disaster recovery plans that ensure continuity of critical healthcare services in the event of a cyberattack.
- Test and validate the effectiveness of security elements within cloud-based disaster recovery and business continuity plans.
- Create and enforce security policies and controls that comply with healthcare and government regulations (HIPAA, HITECH, etc.), and align with cloud specific best practices and the HITRUST security framework.
- Ensure that security protocols for cloud and hybrid infrastructures meet healthcare regulations and industry frameworks.
- Update cloud security policies, baselines, and procedures based on evolving threats and cloud compliance requirements.
- Document cloud security practices and prepare for cloud-specific external and internal audits.
- Document all security incidents and mitigation actions in line with HIPAA breach notification and HITRUST requirements.
- Resolve penetration test findings before they are exploited.
- Configure firewalls, antivirus software, and cloud-native security solutions (e.g., Azure Firewall) to secure hybrid IT infrastructure.
- Manage identity and access management (IAM) solutions, leveraging on-prem Active Directory and Microsoft Entra ID in a hybrid configuration to ensure only authorized personnel access cloud-based sensitive data.
- Implement and maintain encryption solutions for data in transit and at rest within both on-premises and cloud environments.
- Ensure data encryption and privacy measures for protected health information (PHI) are implemented across hybrid and multi-cloud environments.
- Manage secure data storage, backup (Veeam), and disaster recovery for on-prem and cloud-based resources, preventing data loss or unauthorized access.
- Conduct regular privacy impact assessments on cloud platforms, to identify and mitigate risks to sensitive data.
- Educate Currance employees on cloud-specific security best practices, cloud phishing threats, and cybersecurity principles.
- Develop, deliver and maintain a training program that highlights employee responsibilities in securing digital resources and staying compliant with security policies.
- Collaborate with compliance officers to ensure IT activities are aligned with healthcare regulations, aligned with HITRUST requirements and compliant with cloud service standards.
- Collaborate with cross-functional teams to integrate cloud security measures throughout DevOps pipelines, ensuring secure software development and deployment.
- Perform other duties as assigned.
- Bachelor’s degree in Computer Science or equivalent experience
- 10+ years of system, network and/or application security experience
- 10+ years experience in supporting Windows server required + Linux security experience
- 5+ years of Azure cloud security engineering required.
- Minimum 5 years of experience in infrastructure or application-level security testing and auditing
- 5+ years of experience with Firewalls and VPN devices, SSL, HTTP/HTTPS, SSH, IPSEC, TCP/IP, LDAP, PGP, SFTP, Windows desktop/laptop and server operating systems, Windows Server, Active Directory, Group Policy Objects, Spam filters, Anti-Spyware and Anti-virus, Microsoft/Office 365 security services (incl. Multi-factor Authentication) and integration with on-premises Active Directory, scripting with Perl, Python, or PowerShell.
- Microsoft Azure Security Engineer Associate, Cybersecurity Architect Expert, Azure Solutions Architect Expert are essential.
- CISSP, CISM, CCSFP, and/or CISA highly preferred
- CCSP, AWS Certified Security, OSCP, GCIH, and/or CDP preferred
- Advanced knowledge of Azure security services (Azure Security Center, Azure Sentinel, Azure Active Directory, Azure Firewall, etc.). Additional knowledge of AWS security tools (AWS IAM, GuardDuty, AWS WAF, etc.) is a plus.
- Thorough knowledge of common industry security tools (Tenable, Sophos, Barracuda Defense, etc.)
- Comprehensive understanding of secure network architecture, firewall configuration, VPNs, virtual networks, and application security within both cloud and hybrid environments.
- Thorough knowledge of healthcare regulations and security frameworks such as HIPAA, HITECH, HITRUST, NIST, and SOC 2, with the ability to apply these to cloud environments.
- Expertise in Azure Active Directory, Multi-Factor Authentication (MFA), Conditional Access, and role-based access control (RBAC) principles.
- Advanced knowledge of encryption protocols, key management (e.g., Azure Key Vault), and data privacy standards for protecting sensitive information, especially PHI.
- Strong background in threat intelligence, incident response frameworks, and experience with advanced threat detection tools.
- Familiarity with risk assessment methodologies, risk prioritization, and mitigation techniques for cloud security
- Knowledge of vulnerability scanning, patch management processes, and experience with vulnerability management tools like Qualys, Nessus, or Azure Defender.
- Familiarity with disaster recovery planning and testing, particularly in cloud environments, ensuring seamless failover and continuity of critical operations.
- Strong expertise in configuring, managing, and optimizing Azure security tools, including Azure Defender, Azure Policy, and Log Analytics.
- Proficiency in scripting languages such as PowerShell, Python, or Bash for automation, particularly for security tasks and deployments in cloud environments.
- Experience managing SIEM solutions, especially Azure Sentinel, for monitoring, alerting, and investigating potential security threats.
- Skills in conducting penetration tests and creating threat models, with the ability to find and address cloud vulnerabilities proactively.
- Strong organizational and project management skills, with the ability to lead and prioritize multiple security projects.
- Proficient in creating, enforcing, and continually updating security policies and practices, incident responses, audit reports, and creating comprehensive security documentation for compliance and regulatory purposes.
- Ability to communicate technical information effectively to both technical and non-technical stakeholders, including senior management and other departments.
- Strong capability to proactively identify threats, monitor ongoing threats, and manage the incident lifecycle from detection to resolution.
- Capable of leading security initiatives, mentoring junior team members, and contributing to a positive security culture within the organization.
Apply for this position
Required*