Who You AreYou are a hands-on, deeply technical Security Engineer who designs, builds, deploys, and operates security across cloud, application, network, and physical infrastructure- not from the sidelines, but with your hands on the tools. You are fluent in the Microsoft Azure and Entra ecosystem, you understand networking and firewall rules cold, and you are just as comfortable reviewing application code as you are tuning detections in an XDR/SIEM console and running an incident to ground. You stay current with emerging threats and technologies, you automate what should be automated, and you have enough compliance grounding to translate technical controls into evidence auditors trust. You thrive in a new, fast-paced, high-demand environment and take direct ownership of the security and resilience of the systems that protect our patients' healthcare data.
Role's Responsibilities- Designing, building, deploying, and managing security controls hands-on across OnMed's cloud, application, and network environments- owning the outcomes directly rather than overseeing them from a distance.
- Architecting and hardening the Microsoft Azure and M365/Entra environment-identity, network security groups, firewall rules, and encryption at-rest and in-transit- along with corporate and CareStation field-device endpoints.
- Operating and tuning the security stack day to day: XDR/MDR, SIEM, and SOC workflows-building and refining detections, triaging alerts, and working them hands-on.
- Leading incident response end to end: triage, containment, eradication, root cause analysis, and documentation.
- Designing, reviewing, and maintaining network and firewall architecture-segmentation, rule sets, VPN, and Zero Trust access for the remote workforce and field devices.
- Reviewing application code, integrations, and system designs (in-house and vendor-built) for security gaps, and partnering with engineering on remediation.
- Automating security operations and repetitive tasks through scripting where it strengthens detection, response, or hardening.
- Administering identity and access in Entra ID- quarterly access reviews, privileged account audits, and MFA/SSO enforcement.
- Maintaining control evidence for SOC 2, HITRUST, FedRAMP, HIPAA, and related frameworks, supporting auditor and assessor requests, and tracking findings through to remediation.
- Where a managed security services provider is used, directing and holding them accountable as an extension of the in-house team-while retaining direct ownership of security outcomes.
- Maintaining security policies, supporting security awareness training, and responding to customer and vendor security questionnaires.
RequirementsKnowledge, Skills & AbilitiesMust Have:- Deep, hands-on experience designing, developing, deploying, and managing security across multiple technology stacks-engineering the controls yourself, not only directing others.
- Strong hands-on expertise with Microsoft Azure cloud security and the M365/Entra ID stack-identity, network security, and workload protection.
- Excellent understanding of networking and firewall rules-segmentation, NGFW and Azure Firewall rule design and administration, VPN, IDS/IPS, and Zero Trust Network Access across remote users and field devices.
- Application security depth-reviewing code, integrations, and system designs for vulnerabilities, with familiarity with the OWASP Top 10 and SAST/DAST tooling.
- Hands-on experience operating XDR/MDR, SIEM, and SOC environments-building and tuning detections and working alerts directly.
- Hands-on incident response experience-triage, containment, root cause analysis, and documentation.
- Scripting and automation ability (e.g., PowerShell, Python, KQL) to automate detection, response, and hardening-a strong plus where the role calls for it.
- A working compliance background-practical knowledge of one or more of SOC 2, NIST, CIS, HITRUST, and FedRAMP, including producing control evidence and working with external auditors or assessors.
- Working knowledge of HIPAA-scoped PHI handling, data classification, Security Rule requirements, and breach notification.
- Endpoint and device hardening, with encryption at-rest and in-transit across cloud, corporate, and field-deployed devices.
- Familiarity with AI security: securing AI tools and platforms in use across the organization, and evaluating AI-driven security tooling to defend against AI-enabled threats.
- Strong written communication-this role writes for engineering peers, auditors, vendors, and non-technical leadership regularly.
- Comfort supporting and working in a rapidly growing, fast-paced, high-demand environment.
Nice-to-Have:- Advanced Security Operations automation (e.g., leveraging Elastic).
- Hands-on experience with Palo Alto NGFW, Azure Firewall administration, and Cloudflare security services.
- Experience implementing and managing cloud service provider, SaaS, and PaaS security.
- Experience securing IoT, embedded devices, and infrastructure deployed in public settings.
- Vendor risk assessment experience-due diligence, tiering, and ongoing third-party risk tracking-and experience managing an MSSP or MSP relationship.
- Familiarity with GRC or compliance tracking platforms.
- Exposure to agentic AI tooling or AI governance programs.
- Prior healthcare or other regulated-industry experience.
Education & Experience- Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent practical experience.
- 7+ years of experience in information security with substantial hands-on engineering, preferably in a regulated industry.
- 5+ years securing cloud (Azure preferred) and on-prem environments hands-on.
- AZ-500, Security+, GSEC, or CySA+ preferred; OSCP, GCIH, or CISSP/CISM are good nice-to-haves.
BenefitsOnMed provides a competitive salary and benefits package, including unlimited PTO and paid holidays.
The base salary for this role is $130,000 - $140,000 commensurate with the candidate's experience.
#LI-HYBRID
