We are seeking an experienced Senior IT Security Engineer to strengthen the security posture of a large-scale healthcare technology environment through proactive vulnerability discovery and offensive security testing. In this hands-on individual contributor role, you will conduct penetration tests across infrastructure, networks, cloud environments, and web and mobile applications to identify and address security weaknesses before they can be exploited. You will collaborate with engineering, product, and infrastructure teams to validate vulnerabilities, prioritize remediation, and integrate security testing into the software development lifecycle. You will also develop custom security tools, enhance testing methodologies, and simulate real-world adversary techniques to improve organizational resilience. Working in a fast-paced, technology-driven environment, you will help protect sensitive healthcare information while supporting compliance with industry regulations and security standards. This remote opportunity offers the chance to influence offensive security practices, explore emerging threats, and contribute to meaningful improvements in healthcare technology security.
- Conduct penetration testing: Plan and execute comprehensive penetration tests across internal and external infrastructure, networks, web applications, and mobile applications to identify exploitable vulnerabilities.
- Perform application security assessments: Conduct manual and tool-assisted security testing throughout the software development lifecycle, including gray-box testing with access to source code when appropriate.
- Assess cloud security: Test cloud environments across AWS, Azure, and/or Google Cloud Platform, evaluating configurations, identity and access management (IAM), workloads, and potential exposure points.
- Simulate adversary techniques: Reproduce realistic attack scenarios against production and pre-production systems in coordination with engineering, infrastructure, and application owners.
- Develop security tools and automation: Build, maintain, and enhance a toolkit of open-source and commercial security solutions, creating custom scripts and tools to address testing gaps and improve efficiency.
- Document and communicate findings: Produce clear, actionable reports that include risk ratings, vulnerability reproduction steps, potential business impact, and practical remediation recommendations for technical teams and executive stakeholders.
- Support vulnerability remediation: Partner with engineering, infrastructure, and product teams to validate security fixes, track remediation progress, and reduce the time required to address identified vulnerabilities.
- Support compliance and audits: Conduct security testing and provide relevant documentation to support HIPAA, SOC 2, and PCI DSS requirements, assessments, and audits.
- Monitor emerging threats: Track new attack techniques, exploits, vulnerabilities, and threat intelligence relevant to healthcare technology and revenue cycle management systems.
- Participate in collaborative security initiatives: Contribute to tabletop exercises, purple-team activities, internal security awareness programs, and other initiatives that strengthen organizational security capabilities.
- Improve offensive security practices: Help refine testing methodologies, tooling, and operational processes to expand coverage and continuously improve the effectiveness of security assessments.
Requirements
- Professional experience: At least five years of hands-on experience in penetration testing or offensive security, covering infrastructure and network assessments as well as application security testing.
- Security certifications: At least one recognized offensive security certification, such as OSCP, GPEN, GWAPT, GXPN, or CEH, or equivalent demonstrated practical expertise, with a commitment to continued professional development.
- Cloud security expertise: Practical experience conducting security assessments in multiple cloud environments, including AWS, Azure, and/or Google Cloud Platform.
- Security methodologies: Working knowledge of established offensive security frameworks and methodologies, including MITRE ATT&CK, the OWASP Testing Guide, and the Penetration Testing Execution Standard (PTES).
- Security testing tools: Proficiency with open-source and commercial security tools, such as Burp Suite, OWASP ZAP, Nmap, Metasploit, BloodHound, and Nuclei, with the ability to select appropriate tools based on the assessment.
- Scripting and automation: Experience using Python, PowerShell, Bash, or similar scripting languages to develop custom tools and automate repeatable testing tasks.
- Regulatory compliance: Experience working in environments subject to HIPAA, SOC 2, and/or PCI DSS requirements.
- Technical communication: Strong written and verbal communication skills, including the ability to explain technical vulnerabilities, real-world attack scenarios, business risks, and remediation strategies to both technical and nontechnical audiences.
- Independent execution: Ability to manage assessments, prioritize competing tasks, and deliver high-quality results independently within a large, fast-paced, cross-functional organization.
- Advanced security credentials: Additional certifications such as OSWE, OSCE/OSEE, GXPN, CISSP, or CCSP are advantageous.
- Container and orchestration security: Experience assessing containerized environments and Kubernetes deployments is a plus.
- API security testing: Familiarity with REST and GraphQL API security testing beyond traditional web application assessments is preferred.
- Secure development practices: Knowledge of CI/CD pipeline security and integrating security testing into secure software development lifecycle processes is beneficial.
- Open-source contributions: Experience contributing to, developing, or maintaining open-source security tools is an advantage.
- Relevant industry experience: Background in healthcare, healthcare IT, financial services, or other environments handling sensitive information is desirable.
- AI security knowledge: Experience evaluating AI models, AI application frameworks, and AI-powered services for potential security vulnerabilities or exploitation risks is a plus.
Benefits
- Competitive annual salary: Base salary range of $50,640–$137,481.25, depending on experience, skills, qualifications, education, and work location.
- Annual performance bonus: Eligibility for an annual bonus plan with a target of 10% of eligible compensation, subject to the applicable plan terms.
- Healthcare and benefits package: Access to a competitive employee benefits program designed to support employee well-being.
- Fully remote work: The opportunity to work remotely from within the United States.
- Professional development: Opportunities to deepen offensive security expertise, explore emerging technologies, and continue developing technical skills.
- Career growth: Exposure to large-scale healthcare technology systems, complex security challenges, and cross-functional collaboration.
- Meaningful impact: Help protect sensitive healthcare data, improve technology resilience, and strengthen the security of systems that support healthcare providers.
- Collaborative environment: Work alongside engineering, infrastructure, product, and security professionals in a technology-focused organization.
- Continuous learning: Opportunities to contribute to security innovation, improve testing practices, and stay current with evolving cyber threats.
