Staff Security Engineer

openloophealth; United States; Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Competitive compensation

Medical, dental, and vision coverage

Flexible Spending and Health Savings

Generous PTO with hybrid-work

401(k) with company match

Life insurance and pet insurance

Job summary

openloophealth is seeking a Staff Security Engineer to own and mature the security of workforce systems, focusing on endpoint and email security. This hands-on role sits in the Security Architecture & Engineering function, partnering with Security Operations to ensure tooling serves downstream users.

You will own and harden macOS/Windows fleet controls, design MDM/MAM policies protecting PHI data, and manage email security across Google Workspace while advancing security standards and automation

Qualifications

• 8+ years of security engineering experience with end-to-end ownership.
• Hands-on expertise in endpoint and email security.
• Experience deploying MDM/MAM platforms and email security.
• Familiarity with CIS Benchmarks and fleet-scale compliance.
• Exposure to cloud security fundamentals (AWS) and network security.
• Experience in regulated environments with audit evidence.

Responsibilities

• Engineer and harden security controls for macOS and Windows fleet, including MDM and encryption.
• Design MDM/MAM policies to protect PHI data on managed and BYOD devices.
• Deploy and operate an enterprise browser for secure SaaS/web access.
• Apply CIS Benchmark baselines and track drift with audit-ready evidence.
• Own email security for Google Workspace including SPF/DKIM/DMARC and phishing defenses.
• Write standards and runbooks; automate repetitive work via scripting.

Skills

Security engineering

Endpoint security

Email security

Scripting (Python/Bash/PowerShell)

DevSecOps practices

Tools

Kandji

Jamf

Intune

Google Workspace security tooling

Okta

Job description

Role overview

A telehealth infrastructure company that delivers white-labeled virtual care at scale is hiring a Staff Security Engineer to own and mature the security of the workforce systems the organization depends on every day, with a primary focus on endpoint and email security. This is a hands-on, generalist role with deep engineering ownership in those two domains, setting the technical bar across the company and its subsidiaries. The position sits within a Security Architecture & Engineering function that builds the security platform, partnering closely with Security Operations to ensure tooling serves downstream consumers.

Responsibilities

• Engineer and harden security controls for the macOS and Windows fleet, including MDM, disk encryption, patch compliance, and local admin controls, while keeping clinician and operator workflows intact
• Design MDM and MAM policies that protect company and PHI data on managed and BYOD devices, covering app protection, conditional access, and selective wipe
• Deploy and operate an enterprise browser to secure SaaS and web access, including data controls, session policies, and extension management
• Apply and continuously measure CIS Benchmark baselines across the endpoint fleet, tracking drift, managing documented exceptions, and producing audit-ready evidence
• Own email security for the Google Workspace environment, including SPF, DKIM, DMARC enforcement, phishing and BEC defenses, attachment and link protection, and PHI-aware DLP
• Write security standards, configuration baselines, and runbooks that others can follow independently, and automate repetitive work through scripting

Requirements

• 8+ years of security engineering experience with a track record of owning outcomes end to end, including deep hands-on expertise in endpoint and email security
• Experience deploying and operating MDM/MAM platforms (such as Kandji, Jamf, or Intune) plus email security and enterprise browser platforms
• Hands-on experience implementing CIS Benchmarks and measuring compliance at fleet scale
• Exposure to network security (ZTNA/VPN, DNS filtering, segmentation, or firewall policy) and working knowledge of cloud security fundamentals, preferably AWS
• Familiarity with DevSecOps practices such as infrastructure as code, CI/CD security, and secrets management, plus scripting ability in Python, Bash, PowerShell, or similar
• Experience working in a regulated environment (HIPAA, HITRUST, SOC 2, PCI, or similar) and producing audit evidence, with clear written communication skills

Nice to have

• Healthcare or health tech experience, especially environments handling PHI
• Experience with Okta or another enterprise identity provider
• Background supporting multi-entity organizations with subsidiaries or acquisitions
• Relevant certifications such as GIAC, CISSP, OSCP, or cloud security credentials

Benefits and work setup

• Competitive compensation
• Medical, dental, and vision coverage
• Flexible Spending and Health Savings Accounts
• Generous PTO with hybrid-work flexibility
• 401(k) with company match
• Life insurance, pet insurance, and additional benefits