Lead Security Engineer

Zangmeister Cancer Center; United States; Remote; USD 104,000 - 156,000; Full time

Job summary

American Oncology Network is seeking a Lead Security Engineer to provide hands-on technical leadership for the enterprise security program. You will oversee security tools, monitoring, vulnerability management, incident response, and MSP/MSSP partners across a distributed healthcare environment.

You will lead a small security team, develop personnel, and implement security practices across all AON locations, including HIPAA and NIST-aligned activities.

Qualifications

• Bachelor’s degree in information security or related field preferred.
• 8+ years information security or security engineering experience with hands-on tooling.
• 2+ years leading security staff.
• Experience with MSP/MSSP/MDR providers; SIEM/XDR and vulnerability mgmt experience.
• HIPAA/HITRUST/NIST CSF healthcare security knowledge.
• Experience with Microsoft 365, Azure, Entra ID and Rapid7 insights.
• Healthcare multisite provider experience and EHR familiarity preferred.

Responsibilities

• Own and administer security tech stack including SIEM/SOAR and endpoint protection.
• Lead security event triage and incident investigations with MDR partner.
• Oversee vulnerability scanning, remediation, and patch management.
• Strengthen IAM controls, MFA, and privileged access management.
• Coordinate annual HIPAA/NIST aligned risk assessments and tests.
• Manage vendor and security partner oversight and deliverables.
• Mentor security staff and improve security workflows through automation.

Skills

Security Engineering

Incident Response

Vulnerability Management

Identity and Access Management

Cloud Security

Vendor Oversight

Security Compliance

Team Leadership

Scripting and Automation

Technical Risk Communication

Education

Bachelor’s degree in information security or related field

Certifications: CISSP, GIAC, CCSP, or Microsoft security certifications

Tools

Microsoft 365

Azure

Entra ID

Rapid7 InsightIDR

InsightVM

Bitdefender GravityZone

Mimecast

Delinea Secret Server

Cato

Job description

Lead Security Engineer### Lead Security EngineerApply: United States: Full time: Posted Yesterday: JR7579**Location:**Remote Position**Hiring Range:**$104,200.00 - $155,800.00# **Position Summary** The Lead Security Engineer provides hands-on technical leadership for American Oncology Network’s enterprise security program, overseeing security tools, configurations, monitoring, vulnerability management, incident response, and managed security service partners across a distributed healthcare environment. Reporting to the Director of IT Security, this role leads and develops a team of three security staff, strengthens the protection of patient information and clinical operations, and drives consistent security practices across AON locations.# **Key Performance Areas** **KPA 1: Security Engineering, Tools and Infrastructure**• Own and administer the security technology stack, including SIEM/SOAR, endpoint protection, email security, privileged access management, and secure network access.• Maintain and optimize Rapid7 InsightIDR, InsightVM and InsightConnect, Bitdefender GravityZone, Mimecast, Delinea Secret Server, and Cato security configurations and coverage.• Secure Microsoft 365, Azure and other cloud/SaaS environments by establishing configuration baselines and monitoring security posture.• Manage security tool licensing, coverage, and renewal inputs to maintain appropriate protection and cost-effective utilization.**KPA 2: Threat Detection, Incident Response and Vulnerability Management**• Lead security event triage and incident investigations in partnership with the managed detection and response provider; coordinate containment, recovery, and post-incident reviews.• Oversee vulnerability scanning, prioritization, remediation, and patch management across endpoints, servers, cloud platforms, and network infrastructure.• Document risks associated with legacy systems and validate compensating controls where timely remediation is not feasible.• Develop response runbooks, technical standards, and repeatable procedures to support consistent security operations.**KPA 3: Identity, Access and Security Risk Compliance**• Strengthen identity and access security through multifactor authentication, conditional access, privileged access management, joiner/mover/leaver controls, and periodic access reviews.• Coordinate annual HIPAA- and NIST-aligned security risk assessments, vulnerability assessments, and penetration tests with external assessment partners.• Track and drive remediation of assessment findings and security gaps, communicating technical risks and priorities to stakeholders.• Assess security risks arising from third-party vendors, integrations, newly onboarded sites, and acquired practices.**KPA 4: Vendor and Managed Security Partner Oversight**• Serve as the technical lead and primary day-to-day accountability point for managed service and security partners, including ATG and Rapid7 MDR.• Validate provider deliverables, service quality, investigation work, and adherence to contractual service-level agreements.• Escalate gaps and coordinate corrective action with internal IT stakeholders and external partners.• Promote clear documentation, ownership, and communication across security operations and partner workflows.**KPA 5: Team Leadership and Operational Improvement**• Lead, mentor, and develop security staff by establishing priorities, reviewing deliverable quality, and building technical capabilities.• Provide practical guidance during complex security investigations, remediation activities, and operational issues.• Identify opportunities to improve security workflows through PowerShell, Python, and other scripting or automation methods.• Communicate security risks, operational priorities, and remediation progress clearly to nontechnical leaders and clinical stakeholders.# **Position Qualifications** **Education**· Bachelor’s degree in information security, Computer Science or related field preferred.**Minimum Relevant Experience**· 8+ years of information security or security engineering experience, including hands-on operation of production security tools.· 2+ years leading or mentoring security staff.· Experience overseeing MSP, MSSP, or MDR providers; leading security investigations; and administering SIEM/XDR and vulnerability management technologies.· Knowledge of HIPAA, HITECH, and healthcare security frameworks (HITRUST, NIST CSF).· Practical experience with endpoint, email, network, cloud, and privileged access security, including Microsoft 365, Azure, Entra ID, Rapid7 InsightIDR and InsightVM.· Preferred: Healthcare or multisite provider experience, EHR familiarity (e.g., OncoEMR), and M&A or new-site security integration.**Certifications/Licenses**· Preferred: CISSP, GIAC (GCIH, GCIA, GSEC), CCSP, or Microsoft security certifications.**Skills**· Security Engineering· Incident Response· Vulnerability Management· Identity and Access Management· Cloud Security· Vendor Oversight· Security Compliance· Team Leadership· Scripting and Automation (PowerShell/Python)· Technical Risk Communication**Travel:** 0-25%**Expectations for All Employees**This position description reflects the general duties and responsibilities necessary to perform the principal functions of the job, as identified, and shall not be considered an exhaustive list of job responsibilities which may be inherent in the job. To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed are representative of the knowledge, skill, and/or ability required. The responsibilities listed may be subject to change at any time and individuals may be asked to perform duties outside of their regular responsibilities to support the ongoing business operation needs.**Americans with Disabilities Act (ADA) Compliance**The essential functions described herein are intended to define the fundamental duties of the position and serve as the minimum requirements for performance. They do not represent an exhaustive list of all job duties that may be required. AON complies with the Americans with Disabilities Act (ADA) and applicable state and local laws. The Company will engage in an interactive process to evaluate and, where appropriate, provide reasonable accommodations to qualified individuals with disabilities, provided such accommodations do not impose an undue hardship on the business.**Physical Requirements**· Sitting· Keyboard use· Minimal lifting· Long screen exposure**Cognitive Requirements**· Time management· Effective written/verbal communication· Policy interpretation**Environmental Requirements**· Home office setup· Minimal external environmental exposure**Accommodation Notes**· Flexible hours· Ergonomic home office guidance· Communication software accessibility #LI-REMOTE### About Us**American Oncology Network**AON is an alliance of physicians and veteran healthcare leaders dedicated to ensuring the long-term success and viability of oncology diagnosis and treatment in community-based settings. It is the fastest growing national network of community oncology practices delivering local access to exceptional cancer care.AON serves its expanding network of partner practices by providing proven practice management expertise. Our employees across the country work together to empower physicians to make cancer care better. By driving integrated, collaborative care, we are proudly helping community oncologists deliver the highest quality care to every patient.Cancer touches everyone. Being able to make a difference in the lives of those fighting this disease is something our employees at AON cherish and never take for granted. A career in oncology offers all sorts of rewards. But working at AON offers employees more than most.* As a fast-growing national company, the opportunity to join a national workforce with flexible work options is available. We offer competitive compensation packages that include comprehensive health insurance with a robust provider network. Our 401k, which offers a 100% match and investment options, is available to full-time and part-time staff members, and we feature a generous Paid Time Off (PTO) program.* At AON, we offer you more than a job, we offer you a career. As a network of independent oncology practices working together as one, we host annual summits each year, providing our employees a chance to collaborate with AON peers from across the country. Promoting from within is a priority at AON, and we support our team members continued growth through professional development programs and tuition assistance.