Senior IT Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and implement penetration testing strategies for both internal and external infrastructures, networks, as well as web and mobile applications.

• Conduct both manual and automated application security assessments, seamlessly integrated into the Software Development Life Cycle (SDLC), including gray-box testing.

• Assess cloud environments such as AWS, Azure, and/or GCP, focusing on cloud configurations, Identity and Access Management (IAM), and workload-level vulnerabilities.

• Mimic real-world adversary tactics against production and pre-production systems in collaboration with engineering and infrastructure teams.

• Create, manage, and enhance both open-source and commercial security tools.

• Develop custom scripts and tools to address coverage deficiencies.

• Document findings with risk assessments, steps for reproduction, and remediation recommendations for engineering teams and executives.

• Collaborate with engineering, infrastructure, and product teams to verify fixes and expedite remediation timelines.

• Assist with compliance testing and audits for HIPAA, SOC 2, and PCI DSS standards.

• Monitor emerging attack strategies, vulnerabilities, and threat intelligence pertinent to healthcare and revenue cycle technologies.

• Participate in tabletop exercises, purple-team collaboration, and internal security training as necessary.

⛳️ Requirements

• Over 5 years of direct experience in penetration testing or offensive security, encompassing both infrastructure/network and application security assessments.

• At least one acknowledged offensive security certification, such as OSCP, GPEN, GWAPT, GXPN, CEH, or an equivalent demonstrated practical skill set.

• Demonstrated experience testing across various cloud platforms (AWS, Azure, and/or GCP).

• Familiarity with MITRE ATT&CK, the OWASP Testing Guide, and the Penetration Testing Execution Standard (PTES).

• Proficient with open-source and commercial security tools, including Burp Suite, ZAP, Nmap, Metasploit, BloodHound, and Nuclei.

• Ability to script or automate tasks using Python, PowerShell, or Bash.

• Experience working in environments governed by HIPAA, SOC 2, and/or PCI DSS regulations.

• Excellent written and verbal communication abilities.

• Capability to work autonomously in a large, dynamic, matrixed organization.

• Preferred qualifications include OSWE, OSCE/OSEE, GXPN, CISSP, or CCSP.

• Preferred: experience in testing containerized environments and Kubernetes.

• Preferred: knowledge of API security testing with REST/GraphQL.

• Preferred: understanding of CI/CD pipeline security and secure SDLC integration.

• Preferred: experience with contributing to or maintaining open-source security tools.

• Preferred: background in healthcare, healthcare IT, or financial services industries.

• Preferred: familiarity with AI models, harnesses, and exploiting AI services.

🏝️ Benefits

• Annual bonus plan with a target of 10.00%.

• Competitive benefits package.

• Opportunities for continuous learning, collaboration across teams, and exploration of new career paths.

• Chance to make a meaningful impact, think innovatively, and contribute significantly to projects.

• Reasonable accommodation support available for applicants with disabilities.