Staff Security Engineer: Endpoints & Email Security

Alt; Des Moines (IA); Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Medical, Dental & Vision

Hybrid-work flexibility

401(k) with Company Match

Generous PTO

Job summary

OpenLoop is seeking a Staff Security Engineer to own and mature security across endpoints and email, focusing on macOS/Windows fleets, MDM/MAM, and enterprise browser controls. You’ll write standards, implement CIS benchmarks, and drive HITRUST/SOC 2 readiness while mentoring engineers.

You’ll collaborate with SecOps, IT, Compliance, and Engineering, ensuring secure cloud usage and DevSecOps practices in a regulated healthcare environment. This hybrid role supports flexible work arrangements.

Qualifications

• 8+ years in security engineering and end-to-end ownership of outcomes.
• Hands-on expertise in endpoint and email security.
• Experience deploying MDM/MAM platforms and email security.
• Experience deploying an enterprise browser platform.
• Experience implementing CIS Benchmarks at fleet scale.
• Exposure to secure remote access, DNS filtering, segmentation, or firewall policy.
• Cloud security fundamentals (AWS) and IAM, logging, network controls.
• DevSecOps practices and security tooling in CI/CD pipelines.
• Scripting in Python, Bash, or PowerShell.

Responsibilities

• Own and mature security controls for macOS/Windows fleets (MDM, disk encryption, patching, local admin controls).
• Engineer MDM/MAM policies to protect PHI on managed and BYOD devices.
• Deploy and manage an enterprise browser for secure SaaS/web access with data controls and policies.
• Develop CIS Benchmark baselines and track drift for HITRUST and SOC 2 audits.
• Drive least-privilege and maintain controls without impacting clinicians and operators.
• Own email security for Google Workspace (SPF, DKIM, DMARC, DLP).
• Write security standards, baselines, and runbooks for teams to follow.
• Align controls to HITRUST and SOC 2 evidence, support audits.
• Automate repetitive tasks; mentor SAE and adjacent teams.
• Collaborate with IT/Engineering/Compliance/SecOps translating risk into business terms.

Skills

Endpoint security

Email security

CIS Benchmarks

MDM/MAM platforms

Enterprise browser platform

Cloud security fundamentals

DevSecOps practices

Scripting (Python/Bash/PowerShell)

Tools

Kandji

Jamf

Intune

Job description

OpenLoop is seeking a Staff Security Engineer to own and mature security across endpoints and email, focusing on macOS/Windows fleets, MDM/MAM, and enterprise browser controls. You’ll write standards, implement CIS benchmarks, and drive HITRUST/SOC 2 readiness while mentoring engineers.

You’ll collaborate with SecOps, IT, Compliance, and Engineering, ensuring secure cloud usage and DevSecOps practices in a regulated healthcare environment. This hybrid role supports flexible work arrangements.