Security Operations Engineer

OpenKrill; United States; On-site; USD 120,000 - 180,000; Full time

Job summary

DeepHealth is seeking a Security Operations Engineer to build and operate the security controls, tooling, and automation across its cloud and corporate environments. You will configure and maintain the enterprise security tooling stack, develop detection content, and automate tasks to keep controls repeatable and auditable.

Reporting to the Director, Security Operations, you will work within HIPAA, ISO/IEC 27001, and SOC 2 governed framework and coordinate with security operations watch for

Qualifications

• 4+ years in security operations, security engineering, or similar technical security role.
• Bachelor's degree in IT, CS, cybersecurity, or related field, or equivalent experience.
• 2+ years cloud security experience across at least one major provider (GCP or AWS preferred).
• 2+ years operating and tuning a SIEM platform with detection content and log sources.
• 1+ year administering Microsoft 365 and Entra ID security controls in hybrid environment.
• Scripting in Python/PowerShell/Bash required; Terraform experience preferred.
• Familiarity with NIST CSF, ISO/IEC 27001, SOC 2.
• Ability to communicate technical findings clearly to technical and non-technical audiences.
• Ability to work independently and escalate appropriately.
• Willingness to support incident response outside standard hours.
• Experience with healthcare or regulated industry and HIPAA familiarity (preferred).
• Experience with MSP collaborations (preferred).

Skills

Security operations

Cloud security

SIEM management

Automation scripting

Threat detection & incident response

Vulnerability management

Communication

Independent work

HIPAA knowledge

Education

Bachelor's degree or equivalent

Tools

Terraform

Job description

The Security Operations Engineer builds and operates security controls, tooling, and automation across DeepHealth's cloud and corporate environments. This role is responsible for configuring, integrating, and maintaining the enterprise security tooling stack, developing detection content, and automating security operations tasks so that controls are repeatable, version-controlled, and auditable.Working within DeepHealth's established security frameworks and under the direction of the Director, Security Operations, this position operates and tunes security controls, detection content, and guardrails. Independent validation of those controls sits with the security operations watch function — a deliberate separation that keeps the control environment defensible under audit. Remediation follows system ownership across Cloud Operations, Platform, and Application Development; this role supplies technical guidance and implements fixes directly where the control is security-owned.This position operates within a regulated healthcare environment across a global operating footprint, with obligations under HIPAA, ISO/IEC 27001, and SOC 2. The role reports to the Director, Security Operations, with future reporting to the Manager, Security Operations as that position is established.

PLEASE NOTE: This is not an exhaustive list of all duties, responsibilities and requirements of the position described above. Other functions may be assigned and management retains the right to add or change duties at any time.

Minimum Qualifications, Education and Experience

• 4+ years of hands-on experience in security operations, security engineering, or a comparable technical security role. (Required)
• Bachelor's degree in information technology, computer science, cybersecurity, or a related field, or equivalent professional experience. (Required)
• 2+ years of hands-on cloud security experience across at least one major cloud provider; Google Cloud Platform and Amazon Web Services preferred. (Required)
• 2+ years operating and tuning a SIEM platform, including working with detection content and log sources. (Required)
• 1+ year administering Microsoft 365 and Entra ID security controls in a hybrid directory environment. (Required)
• Working knowledge of security automation; experience with scripting and infrastructure-as-code is required, with Terraform experience preferred. (Required)
• Working knowledge of cloud security posture management and preventive controls. (Required)
• Working knowledge of container and Kubernetes security, including role-based access control and image scanning. (Required)
• Working knowledge of secrets management tooling and practices. (Required)
• Practical experience with endpoint detection and response tooling. (Required)
• Working knowledge of vulnerability management and the finding remediation lifecycle, including risk-based prioritization. (Required)
• Scripting capability in at least one of: Python, PowerShell, or Bash. (Required)
• Familiarity with recognized security frameworks including NIST Cybersecurity Framework, ISO/IEC 27001, and SOC 2. (Required)
• Able to communicate technical findings clearly in writing and verbally to both technical and non-technical audiences. (Required)
• Able to manage assigned work independently and escalation appropriately. (Required)
• Available to support incident response activity outside standard business hours as required. (Required)
• Microsoft Office experience. (Required)
• Industry certification such as Security+, CompTIA CySA+, or a cloud provider security certification. (Preferred)
• Experience in healthcare, medical device, or another regulated industry, and working familiarity with HIPAA obligations. (Preferred)
• Experience working alongside or integrating with a managed security service provider. (Preferred)

Quality Standards

Communicates, cooperates, and consistently functions professionally and harmon