Senior IT Security Engineer
New
J
JobgetherHealthcare technology
Work remotely from within the United StatesFull-TimeSenior
SalaryBase salary range of $50,640–$137,481.25
Apply NowOpens the employer's application page
Job Details
- Experience
- At least five years of hands-on experience in penetration testing or offensive security
- Required Skills
- AWSPythonGCPAzureHIPAA
Requirements
- At least five years of hands-on penetration testing or offensive security experience covering infrastructure, networks, and application security.
- At least one recognized offensive security certification, such as OSCP, GPEN, GWAPT, GXPN, or CEH, or equivalent demonstrated practical expertise.
- Practical experience conducting security assessments in multiple cloud environments, including AWS, Azure, and/or Google Cloud Platform.
- Working knowledge of MITRE ATT&CK, the OWASP Testing Guide, and the Penetration Testing Execution Standard (PTES).
- Proficiency with security tools such as Burp Suite, OWASP ZAP, Nmap, Metasploit, BloodHound, and Nuclei.
- Experience using Python, PowerShell, Bash, or similar scripting languages to develop tools and automate testing tasks.
- Experience in environments subject to HIPAA, SOC 2, and/or PCI DSS requirements.
- Ability to manage assessments, prioritize tasks, and deliver results independently in a cross-functional organization.
- Additional certifications such as OSWE, OSCE/OSEE, GXPN, CISSP, or CCSP are advantageous.
- Container and Kubernetes security assessment experience is a plus.
- Familiarity with REST and GraphQL API security testing is preferred.
- Knowledge of CI/CD pipeline security and integrating testing into secure software development lifecycle processes is beneficial.
Responsibilities
- Plan and execute penetration tests across internal and external infrastructure, networks, web applications, and mobile applications.
- Conduct manual and tool-assisted application security testing throughout the software development lifecycle, including gray-box testing when appropriate.
- Assess AWS, Azure, and/or Google Cloud Platform environments, including configurations, IAM, workloads, and exposure points.
- Simulate realistic attack scenarios against production and pre-production systems with engineering, infrastructure, and application owners.
- Build and maintain security testing tools, including custom scripts to address testing gaps and improve efficiency.
- Document findings with risk ratings, reproduction steps, business impact, and remediation recommendations.
- Partner with engineering, infrastructure, and product teams to validate fixes and track vulnerability remediation.
- Conduct security testing and provide documentation supporting HIPAA, SOC 2, and PCI DSS assessments and audits.
- Track emerging attack techniques, exploits, vulnerabilities, and threat intelligence relevant to healthcare technology and revenue cycle management systems.
- Contribute to tabletop exercises, purple-team activities, security awareness programs, and improvements to offensive security practices.
View Full Description & ApplyYou'll be redirected to the employer's site
