Cybersecurity Engineer

DrFirst, Inc.; United States; On-site; USD 65,000 - 80,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401K with company match

Paid time off and holidays

Continuing education funds

Job summary

DrFirst, Inc. is seeking a Cybersecurity Engineer to join our dynamic security team. You will triage security alerts, perform security risk assessments, and contribute to DevSecOps practices in a fast-paced environment. Your role is pivotal in automating SOC 2 and HITRUST evidence collection, enhancing security operations through innovative AI solutions.

Ideal candidates have 2-3 years in cybersecurity, strong scripting skills, and a solid understanding of AWS and GCP platforms. We offer competitive compensation and a comprehensive benefits package to support your development and well-being.

Qualifications

• 2–3 years in a cybersecurity engineering or security operations role.
• Familiarity with SOC 2, HITRUST, or NIST 800-53.
• Experience completing customer security questionnaires.

Responsibilities

• Triage alerts and complete security risk assessments.
• Contribute to DevSecOps practices and pipeline security.
• Automate SOC 2 / HITRUST evidence collection.

Skills

Cybersecurity engineering

Scripting (Python, PowerShell)

DevSecOps practices

Incident response

AI fluency

Tools

AWS

GCP

SentinelOne

Splunk

Tenable

Job description

About DrFirst

For 25 years, DrFirst has empowered providers and patients to achieve better health through intelligent medication management. We improve healthcare workflows and help patients start and stay on therapy with end-to-end solutions that enhance prescription access, affordability, and adherence. Our solutions help 100 million patients a year and are used by more than 420,000 prescribers, 71,000 pharmacies, 270 EHRs and health information systems, and over 2,000 hospitals in the U.S. This is a great opportunity to be a part of a successful Healthcare IT company experiencing significant growth. Here you\'ll get to work with some of the smartest and most interesting people around; solving unique and complex challenges in healthcare on a scale matched by a few companies. If you get excited about stretching yourself in new ways, developing yourself to your fullest potential, care about working with smart colleagues; we want to talk to you!

Position Overview

At DrFirst, we play in the major leagues. Our 5-person security team covers what most organizations staff with ten or more — not by working longer, but by working smarter. We are adding a Cybersecurity Engineer to grow that team, and we are looking for someone who earns their place as an engineer — not an analyst.

The difference matters. Analysts follow playbooks. Engineers understand the systems well enough to know when something is wrong — and to build the automation that catches it faster next time. You will triage alerts, complete security risk assessments, contribute to DevSecOps, and collect audit evidence. But you will do all of it with enough platform depth that you can spot a misconfiguration during evidence collection, not just screenshot and move on.

More importantly, you use AI the way an engineer uses any powerful tool — to rethink how work gets done, not just to finish it faster. You do not just prompt Claude to complete a task. You ask whether the task should exist in its current form at all, and if not, you build something that eliminates it. You have done this already. Others would describe you this way — keep reading.

What You Contribute

You report to the VP Security and work alongside two Principal Security Engineers and one Senior Cybersecurity Engineer. You own your queue and contribute to shared goals. You are not handed a checklist — you are expected to understand what you are looking at.

Domain, Scope, Cadence

• Security Operations: Alert triage across SentinelOne, Proofpoint, Splunk, AWS Security Hub, GCP SCC, Tenable, Zscaler. Security inbox, customer questionnaires, SRAs, KnowBe4, onboarding/offboarding compliance, endpoint and allowlist controls.
• Steady state: DevSecOps — Contributor. Contribute alongside a Principal who spends 60% of his time here. Pipeline security, secure SDLC, security tooling integration. Tangible deliverables.
• Ongoing: Security Incident Response — Incident response, proactive threat prevention, security reviews for new product features.
• As needed: Audit Evidence Collection — SOC 2 / HITRUST evidence for your domains. Platform depth matters — you flag misconfigurations, not just collect screenshots.

What You Will Work On

Strategic Initiatives You Step Into From Day One Active initiatives with momentum. You contribute immediately.

• Audit Evidence Automation — Active initiative to automate SOC 2 / HITRUST evidence collection using Claude Code — moving the team from collectors to SME reviewers. You contribute to this from day one.
• Data Governance Automation — Retention policy framework in progress. Drive AI-assisted implementation by data stream and category, coordinate purge processes across email and corporate data stores.
• Corporate Claude Environment — Contribute to security architecture, guardrails, and governance for non-engineering staff using Claude for automation and data access via MCPs.

How We Work

Security is one of the fastest-moving domains in tech — AI is expanding the attack surface, automating threats, and simultaneously giving defenders more leverage than ever. We are not treading water here. We are building an AI-driven security function and looking for someone who wants to help shape what that looks like — not be handed a blueprint.

Day 30 Milestones

This is the kind of place where you can actually get things done — not just talk about doing them. By the end of your first 30 days:

• Security inbox is running clean — SRAs and customer questionnaires completed on time, using existing automation with your own SME judgment applied to the output
• Alert triage cadence established — queue owned, first tuning improvements documented
• At least one AI automation shipped — not planned, not in progress — live, with measurable time savings. Data governance is one area that needs attention.
• An informed point of view on at least one configuration or gap in our stack — something you observed, not something you were told
• At least one tangible DevSecOps deliverable contributed alongside the principal
• Scrums: tickets updated, blockers surfaced, closed items to show — not a status report on what you are still figuring out

Qualifications

• 2–3 years in a cybersecurity engineering or security operations role
• Familiarity with SOC 2, HITRUST, or NIST 800-53; HIPAA/PHI audits
• Experience completing customer security questionnaires or security risk assessments — you understand what you are attesting to
• Scripting or automation experience — Python, PowerShell, or Bash — applied to real operational problems, committing to GitLab, and building applications where warranted
• Exposure to DevSecOps practices — pipeline security, secure SDLC, or security tooling integration

AI-Augmented Engineering — Non-Negotiable AI fluency is a baseline expectation here — the same way Office 365 proficiency was table stakes a decade ago. You write effective prompts, apply critical thinking to AI output, and catch errors. What sets you apart is the engineering mindset on top of that: you continuously look for opportunities to use Claude and Claude Code to automate your work, commit those automations to GitLab, and build toward systems that do not need you to run them.

Platform and Cloud Knowledge — Non-Negotiable We are a software company running production systems on AWS and GCP. You must understand these platforms beyond their security modules — how services are architected, how products are built and deployed, how data flows in production, and where security guardrails must be configured at each layer. Misconfigurations do not announce themselves. Security knowledge without platform knowledge is not enough here.

• AWS: IAM, VPC, Security Hub, GuardDuty, CloudTrail, S3, EC2, Lambda, RDS
• GCP: IAM, VPC Service Controls, Security Command Center, Cloud Logging, GKE, Cloud Run
• SaaS product delivery — CI/CD pipelines, containerization, secrets management, access controls
• Security tooling: SentinelOne, Proofpoint, KnowBe4, Jamf, AWN, KACE, Zscaler (ZIA/ZPA), Okta, Tenable, Splunk

Core Attributes

• Objective-first thinker: Reads the assignment and asks whether it is the right assignment. Does not miss the forest for the trees.
• Moves on blockers: When you identify a dependency, you act on it — same day. You do not build uncertainty into your timeline.
• Understands the stack: Knows what our platforms do and how they are configured — well enough to catch something wrong, not just document it.
• Owns it: Takes the domain, assesses what needs to happen, and makes it happen — without waiting to be told.
• Automates before accepting manual: AI-assisted automation is the default. You build pipelines, not habits. You commit your work.
• Communicates through output: Jira tickets are current, GitLab has your commits, and scrums have closed items — your work is visible without anyone having to ask.

Physical Requirements

• 90% Desk/phone work
• 10% Standing/moving throughout the office

Benefits

• Competitive compensation, with a base salary of $65,000 - $80,000 (Exact compensation may vary based on skills and experience)
• Eligible for Company Performance-based Bonus Program, based on individual and company performance
• Medical, dental, and vision insurance
• 401K eligible after 3 months of employment, with 50% company match up to first 5% of salary contributed to the plan with a 3-year vesting schedule
• HSA for eligible employees enrolled in the HDHP, with a generous company contribution up to $500 for individual coverage and $1000 for family coverage per year
• 100% company-paid short and long-term disability, AD&D, and group life insurance
• Accrued annual paid time off (PTO) of 18 days for the first 3 years of service, increasing thereafter and 7 paid holiday days
• Employee Assistance Program
• Continuing Education funds up to $1500 annually for eligible programs after 1 year of service
• Voluntary benefits including FSA, Hospital indemnity, Accident and Critical Illness insurances