Cloud Security Engineer

TherapyNotes, LLC

Philadelphia (Philadelphia County)

On-site

USD 110,000 - 150,000

Full time

3 days ago

Be an early applicant

Application generator

Get a reply from this employer — a resume and cover letter tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Competitive salary

Health, dental, vision, life, and long

Retirement plan with company match

Annual profit sharing

Personal development/training budget

2-week onboarding plan

Mentorship program

Job summary

TherapyNotes LLC is seeking an experienced Cloud Security Engineer to secure our cloud infrastructure, container workloads, and IaC pipelines in a healthcare-regulated environment. The role focuses on CSPM, Kubernetes security, Zero Trust, and incident response within a collaborative security team.

You will secure Azure-based workloads, manage Enta ID access, and contribute to vulnerability management, audits, and CI/CD security integration. Experience with HIPAA/HITRUST is a plus.

Qualifications

Bachelor's degree in information security, computer science, or related field preferred; equivalent experience considered
5+ years of experience in cloud security engineering or related role
Deep, hands-on experience securing cloud infrastructure and cloud-based applications (Azure preferred, AWS a plus)
Hands-on network security experience and a strong understanding of network architecture, connectivity, segmentation, and firewall controls
Experience securing containerized workloads and Kubernetes environments (e.g., AKS) - network policy, workload identity, runtime protection
Experience with cloud security posture management (CSPM) and remediating misconfigurations across cloud environments
Experience securing IaC orchestration platforms - access control, secrets management, and deployment approval workflows (Terraform, OpenTofu)
Experience with Microsoft Entra ID, including Conditional Access, Entitlement Management, and just-in-time (JIT) privileged access models
Experience with Zero Trust / SASE tooling (e.g., Cloudflare Zero Trust, WAF, Gateway, or equivalent)
Knowledge of security frameworks (NIST, ISO 27001, CIS) and compliance frameworks (HITRUST, PCI DSS)
Proven ability to conduct security assessments, vulnerability management, and incident response
Strong understanding of OS platforms (Windows, Linux) and endpoint security
Industry certifications such as CISSP, SSCP, Security+, or a cloud security certification (Azure/AWS) preferred

Responsibilities

Secure cloud infrastructure and cloud-based applications, with focus on Azure
Secure containerized workloads and Kubernetes environments (AKS) - network policy, workload identity, runtime protection, and container image scanning
Own and mature CSPM across cloud environments
Secure IaC pipelines Terraform/OpenTofu
Manage identities in Microsoft Entra ID through CA, Entitlement Management, and just-in-time (JIT) privileged access models
Review network diagrams and security input on segmentation and sensitive data flows, and work with IT and SRE teams to address concerns
Administer Zero Trust network access and edge security tooling to secure access to corporate and cloud resources
Hands-on management of SIEM, DLP, E/XDR, vulnerability management
Monitor security alerts, respond to and elevate incidents, and participate in on-call rotation
Threat analysis, vulnerability assessments, and risk evaluations; document findings, manage mitigation, and report status to leadership
Develop queries, scripts, integrations, and automated workflows that improve cloud security operations
Collaborate with development teams to ensure security is continuously integrated into the SDLC and CI/CD pipeline
Conduct periodic cloud configuration and access reviews to ensure compliance with security standards
Participate in audits and assessments, supporting governance, risk management, and compliance (GRC) efforts

Skills

Cloud security

Kubernetes security

Zero Trust

CSPM

IaC security

Azure security

Network security

IAM

Threat analysis

SIEM/EDR

Education

Bachelor's degree or equivalent

Tools

Terraform/OpenTofu

AKS

Entra ID

Argo

Flux

Cloudflare Zero Trust

Job description

About Us

TherapyNotes is the go-to superhero for behavioral health Practice Management and EHR software! Our top-notch SaaS solution handles scheduling, billing, documenting, telehealth, and more so clinicians can focus on awesome patient care.

We're a dynamic team of pros who love to innovate and push the envelope, keeping our software cutting-edge. Join us, and let's revolutionize behavioral health software together while making a real difference!

The Position

TherapyNotes is seeking an experienced, hands-on Cloud Security Engineer to secure our cloud infrastructure, containerized workloads, and infrastructure-as-code pipelines. The right candidate brings deep expertise in cloud security posture management, Kubernetes and container security, and Zero Trust network access, and is comfortable working in a healthcare-regulated environment (HIPAA, HITRUST, HITECH). This role also contributes to broader security engineering efforts - vulnerability management, incident response, and identity and access security - as part of a small, collaborative security team.

Required Skills And Experience

Bachelor's degree in information security, computer science, or related field preferred; equivalent experience considered
5+ years of experience in cloud security engineering or related role
Deep, hands-on experience securing cloud infrastructure and cloud-based applications (Azure preferred, AWS a plus)
Hands-on network security experience and a strong understanding of network architecture, connectivity, segmentation, and firewall controls
Experience securing containerized workloads and Kubernetes environments (e.g., AKS) - network policy, workload identity, runtime protection
Experience with cloud security posture management (CSPM) and remediating misconfigurations across cloud environments
Experience securing IaC orchestration platforms - access control, secrets management, and deployment approval workflows (e.g., Terraform, OpenTofu)
Experience with Microsoft Entra ID, including Conditional Access, Entitlement Management, and just-in-time (JIT) privileged access models
Experience with Zero Trust / SASE tooling (e.g., Cloudflare Zero Trust, WAF, Gateway, or equivalent)
Knowledge of security frameworks (NIST, ISO 27001, CIS) and compliance frameworks (HITRUST, PCI DSS)
Proven ability to conduct security assessments, vulnerability management, and incident response
Strong understanding of OS platforms (Windows, Linux) and endpoint security
Industry certifications such as CISSP, SSCP, Security+, or a cloud security certification (Azure/AWS) preferred

Responsibilities

Manage and secure cloud infrastructure and cloud-based applications, with a focus on Azure
Secure containerized workloads and Kubernetes environments (e.g., AKS) - network policy, workload identity, runtime protection, and container image scanning
Own and mature cloud security posture management (CSPM) - continuously identify and remediate misconfigurations across cloud environments
Secure infrastructure-as-code orchestration platforms - access control, secrets management, and deployment approval workflows for Terraform/OpenTofu pipelines
Manage and secure identities in Microsoft Entra ID through Conditional Access, Entitlement Management, and just-in-time (JIT) privileged access models
Review network diagrams and proposed connectivity changes, provide security input on segmentation and sensitive data flows, and work with IT and SRE teams to address identified concerns
Administer Zero Trust network access and edge security tooling to secure access to corporate and cloud resources
Hands-on management of broader security solutions across the organization{{:}} SIEM, DLP, E/XDR, vulnerability management
Monitor security alerts, respond to and elevate incidents, and participate in the incident response on-call rotation
Conduct threat analysis, vulnerability assessments, and risk evaluations; document findings, manage mitigation, and report status to leadership
Develop queries, scripts, integrations, and automated workflows that improve cloud security operations
Collaborate with development teams to ensure security is continuously integrated into the SDLC and CI/CD pipeline
Conduct periodic cloud configuration and access reviews to ensure compliance with security standards
Participate in audits and assessments, supporting governance, risk management, and compliance (GRC) efforts

Additional Skills

Familiarity with GitOps tooling (Argo, Flux) for secure deployment in Kubernetes environments
Network or Systems Engineering background a huge plus
Familiarity with programming/scripting languages a plus
Passion for continuous learning and professional development, with a commitment to staying updated and trained on the latest trends and technologies
Eagerness to engage in new challenges and adapt quickly
Strong work ethic and drive to take ownership of projects and see them through to completion
Strong collaboration skills, able to work effectively with cross functional teams

Benefits

Competitive salary - $110,000-$150,000
Employer sponsored health, dental, vision, life, and disability insurance
Retirement plan with company contribution
Annual company profit sharing
Personal development/training budget
Open, collaborative work environment
Extensive 2-week onboarding plan
Comprehensive mentorship program

Equal Opportunity Employer Statement & Applicant Rights

TherapyNotes LLC is an Equal Opportunity Employer and does not discriminate based on race, color, religion, sex, national origin, age, disability, genetic information, or any other protected status under federal, state, or local law. We are committed to providing a workplace free of discrimination and harassment.For more information about your rights under federal employment laws, please review the following{{:}}