Senior Information Security Analyst

About the Role

We are seeking an experienced Senior Information Security Analyst to strengthen our cybersecurity program and help protect the systems, data, and technology that support our healthcare technology solutions.

In this role, you will lead key information security operations, incident response, vulnerability management, security governance, and compliance initiatives. You will serve as the primary owner of our SOC 2 compliance activities while overseeing security monitoring, optimizing detection capabilities, and driving continuous improvement across our security environment.

The ideal candidate combines strong technical expertise with a proactive, risk-based approach to security. You are comfortable managing security platforms, leading incident investigations, partnering with cross-functional teams, and translating security requirements into practical controls that support business objectives and protect sensitive information.

Security Operations & Incident Response

• Lead security monitoring and incident response operations using SIEM platforms and integrated security technologies.
• Administer and optimize SIEM solutions, including log source onboarding, alert tuning, correlation rules, detection use cases, and integrations with endpoint, cloud, and network security tools.
• Lead security incident investigations, containment, root cause analysis, remediation tracking, and incident documentation.
• Manage third-party security providers, including managed detection and response (MDR) and external security operations center (eSOC) partners, ensuring service quality and contractual compliance.
• Monitor emerging threats, vulnerabilities, and industry best practices to continuously improve the organization's security posture.

Governance, Risk & Compliance

• Develop, maintain, and enforce information security policies, standards, procedures, and controls aligned with SOC 2 and relevant industry frameworks.
• Own SOC 2 compliance activities, including control documentation, evidence collection, audit coordination, continuous monitoring, and audit readiness.
• Maintain security policies, procedures, runbooks, risk documentation, and audit artifacts.
• Support client security assessments, third-party due diligence, RFP security questionnaires, regulatory inquiries, and audit requests.
• Partner with internal stakeholders to identify security gaps, assess risks, and implement appropriate remediation plans.

Vulnerability & Endpoint Security Management

• Manage the vulnerability management lifecycle, including scanning, risk-based prioritization, remediation oversight, and executive reporting.
• Collaborate with IT Operations to implement secure configurations, access controls, endpoint protection, and security best practices.
• Oversee endpoint and bring-your-own-device (BYOD) security programs, including mobile device management (MDM) enforcement and secure access policies.
• Evaluate security risks across endpoints, cloud services, SaaS applications, and other organizational technology assets.

Security Awareness & Technology Strategy

• Administer and enhance the security awareness program through phishing simulations, employee training, reporting, and targeted education initiatives.
• Evaluate, recommend, and implement security technologies based on organizational risk, business needs, cost-benefit analysis, and operational requirements.
• Lead security technology integrations and collaborate with internal teams and external partners to improve security effectiveness.
• Promote a culture of security awareness, accountability, and continuous improvement across the organization.

Additional Responsibilities

Perform other related duties as assigned.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or an equivalent combination of education and professional experience.
• 7+ years of experience in cybersecurity, information security, IT security operations, or a related discipline.
• Hands-on experience administering and optimizing SIEM platforms, including log management, alert tuning, correlation rule development, and operational ownership.
• Demonstrated experience implementing and enforcing security policies, governance frameworks, and SOC 2 controls.
• Strong background in security operations, incident response, vulnerability management, and endpoint security.
• Experience leading cross-functional security initiatives and collaborating with internal stakeholders and external security service providers.
• Strong analytical, problem-solving, documentation, and communication skills.
• Ability to manage competing priorities, communicate security risks effectively, and drive remediation efforts to completion.

Preferred Qualifications

• 10+ years of experience in cybersecurity, security operations, or information security leadership.
• Direct experience supporting SOC 2 audits, including control ownership, evidence management, and audit readiness.
• Experience administering security awareness platforms, such as KnowBe4.
• Experience working with MDR providers, eSOC partners, or other managed security service providers.
• Advanced security certifications, such as CISSP, CISM, or equivalent.
• Microsoft Security certifications, such as SC-200 or SC-300.
• SOC 2, governance, risk management, and compliance-related certifications or specialized training.

Technical Skills

• SIEM & Security Monitoring: Microsoft Sentinel, Sumo Logic, or equivalent platforms.
• Threat Detection & Incident Response: Security event analysis, threat investigation, incident containment, and remediation.
• Vulnerability Management: Vulnerability scanning, risk prioritization, remediation tracking, and reporting.
• Endpoint Security: Endpoint detection and response (EDR), endpoint protection, and mobile device management (MDM).
• Identity & Access Management: IAM solutions, authentication, authorization, and access controls.
• Cloud & SaaS Security: Microsoft 365, cloud security technologies, and SaaS application protection.
• Governance & Compliance: SOC 2 controls, security policies, risk management, audit documentation, and compliance reporting.
• Security Awareness: Employee training, phishing simulations, and awareness program administration.

What We Offer

• Competitive salary and performance bonus program
• Fully remote work environment
• Comprehensive benefits package including 401k match
• 19 days of PTO per year; 10 holidays per year
• Opportunity to work in a mission-driven organization where your work directly shapes clarity, confidence, and better outcomes across healthcare

Travel

Up to 10% travel, based on business needs. While our roles are 100% remote, we do get together a few times a year for up to one week. Employees are given ample notice and attendance is expected.

Work Environment

This position operates primarily in a remote work environment and requires the ability to remain in a stationary position for extended periods while performing work at a desk or workstation. The employee must be able to operate standard office equipment, including a computer, keyboard, mouse, webcam, and telephone.

The role also requires the ability to occasionally move throughout a workspace to access files, office equipment, and work-related materials. Effective communication, both written and verbal, is essential for interacting with employees, clients, and stakeholders.