US-IT Security Eng Sr

R1 RCM, Inc.; Boise (ID); À distance; USD 82 000 - 137 000; Plein temps

Avantages offerts par ce poste

Annual performance bonus

Résumé du poste

R1 RCM Inc. is seeking a Senior IT Security Engineer to drive penetration testing across infrastructure, networks, and applications in a healthcare technology environment. You will work across multiple cloud platforms and advance testing methodologies and tooling as an individual contributor.

The role emphasizes hands-on testing with opportunities to shape security processes, not just follow a checklist. Remote USA-based position with a strong security posture and collaboration across teams.

Qualifications

• 5+ years of hands-on penetration testing across infrastructure and applications.
• OSCP/GPEN/GWAPT or equivalent demonstrated hands-on skill.
• Experience testing in AWS/Azure/GCP cloud environments.
• Knowledge of MITRE ATT&CK, OWASP Testing Guide, and PTES.

Responsabilités

• Plan and execute penetration tests across internal and external infrastructure, networks, and web and mobile applications.
• Perform application security testing — manual and tool-assisted — integrated into the SDLC, including gray box testing where applicable.
• Test across multiple cloud environments (AWS, Azure, and/or GCP), including IAM and workload exposures.
• Simulate real-world adversary techniques against production and pre-production systems with engineering and infra teams.
• Build, maintain and extend a toolkit spanning open-source and commercial tooling; write custom scripts to close gaps.
• Document findings with risk ratings, reproduction steps, and remediation guidance for engineers and executives.
• Partner with engineering, infra, and product teams to validate fixes and reduce time-to-remediation.
• Support testing tied to HIPAA, SOC 2, and PCI DSS assessments and audits.
• Track emerging attack techniques and threat intelligence relevant to healthcare environments.
• Contribute to tabletop exercises, purple-team activities, and internal security training.

Connaissances

Penetration testing

Cloud testing

Security tooling

Scripting: Python/PowerShell/Bash

Certification: OSCP/GPEN

HIPAA/SOC2/PCI DSS

Communication

Outils

Burp Suite

Nmap

Metasploit

OWASP ZAP

BloodHound

Description du poste

Remote, USA

Full time

R260000007339

About the Role

The Offensive Security team is hiring a Senior IT Security Engineer to strengthen how we find and fix vulnerabilities before attackers do. You'll run hands‑on penetration tests across infrastructure, networks, and applications, work across multiple cloud environments, and help mature testing methodology and tooling for a healthcare technology company operating at real scale. This is an individual contributor role with room to shape process, not just execute against a checklist.

Responsibilities

• Plan and execute penetration tests across internal and external infrastructure, networks, and web and mobile applications.
• Perform application security testing — manual and tool-assisted — integrated into the SDLC, including source‑code‑assisted ("gray box") testing where applicable.
• Test across multiple cloud environments (AWS, Azure, and/or GCP), including cloud configuration, IAM, and workload‑level exposures.
• Simulate real‑world adversary techniques against production and pre‑production systems, in coordination with engineering and infrastructure owners.
• Build, maintain, and extend a toolkit spanning both open‑source and commercial tooling; write custom scripts and tools to close gaps in existing coverage.
• Document findings with clear risk ratings, reproduction steps, and remediation guidance, for both engineering teams and executive stakeholders.
• Partner with engineering, infrastructure, and product teams to validate fixes and reduce time‑to‑remediation.
• Support testing tied to compliance obligations, including HIPAA, SOC 2, and PCI DSS assessments and audits.
• Track emerging attack techniques, exploits, and threat intelligence relevant to healthcare and revenue cycle technology environments.
• Contribute to tabletop exercises, purple‑team collaboration, and internal security training as needed.

Minimum Qualifications

• 5+ years of hands‑on experience in penetration testing or offensive security, spanning both infrastructure/network and application security testing.
• At least one recognized offensive security certification — e.g., OSCP, GPEN, GWAPT, GXPN, CEH, or equivalent demonstrated hands‑on skill — with a track record of pursuing further certification.
• Practical experience testing in multiple cloud environments (AWS, Azure, and/or GCP), not just on‑prem infrastructure.
• Working knowledge of established methodologies and frameworks: MITRE ATT&CK, the OWASP Testing Guide, and PTES.
• Fluency with both open‑source and commercial security tooling (e.g., Burp Suite, Zap, Nmap, Metasploit, BloodHound, Nuclei, OWASP ZAP) and the judgment to pick the right tool for the job.
• Scripting or automation ability (Python, PowerShell, or Bash) to build custom tooling and speed up repeatable testing.
• Experience operating in environments subject to HIPAA, SOC 2, and/or PCI DSS.
• Strong written and verbal communication — you can explain a finding's real‑world impact to an engineer and to a non‑technical stakeholder in the same afternoon.
• Comfort operating independently inside a large, fast‑paced, matrixed organization.

Preferred Qualifications

• Advanced certifications: OSWE, OSCE/OSEE, GXPN, CISSP, or CCSP.
• Experience testing containerized environments and Kubernetes.
• API security testing experience (REST/GraphQL), beyond standard web app testing.
• Familiarity with CI/CD pipeline security and secure SDLC integration.
• Experience contributing to or maintaining open‑source security tools.
• Healthcare, healthcare IT, or financial services industry experience.
• Experience with AI models, harnesses, and exploiting AI services.

For this US-based position, the base pay range is $50,640.00 - $137,481.25 per year . Individual pay is determined by role, level, location, job‑related skills, experience, and relevant education or training.

This job is eligible to participate in our annual bonus plan at a target of 10.00%

The healthcare system is always evolving — and it’s up to us to use our shared expertise to find new solutions that can keep up. On our growing team you’ll find the opportunity to constantly learn, collaborate across groups and explore new paths for your career.

Our associates are given the chance to contribute, think boldly and create meaningful work that makes a difference in the communities we serve around the world. We go beyond expectations in everything we do. Not only does that drive customer success and improve patient care, but that same enthusiasm is applied to giving back to the community and taking care of our team — including offering a competitive benefits package. (http://go.r1rcm.com/benefits)

R1 RCM Inc. (“the Company”) is dedicated to the fundamentals of equal employment opportunity. The Company’s employment practices , including those regarding recruitment, hiring, assignment, promotion, compensation, benefits, training, discipline, and termination shall not be based on any person’s age, color, national origin, citizenship status, physical or mental disability, medical condition, race, religion, creed, gender, sex, sexual orientation, gender identity and/or expression, genetic information, marital status, status with regard to public assistance, veteran status or any other characteristic protected by federal, state or local law. Furthermore, the Company is dedicated to providing a workplace free from harassment based on any of the foregoing protected categories.

If you have a disability and require a reasonable accommodation to complete any part of the job application process, please contact us at 312-496-7709 for assistance.

CA PRIVACY NOTICE: California resident job applicants can learn more about their privacy rights California Consent (https://f.hubspotusercontent20.net/hubfs/4941928/California%20Consent%20Notice.pdf)

To learn more, visit: R1RCM.com

Visit us on Facebook (https://www.facebook.com/R1RCM)

R1 is the leader in healthcare revenue management, helping providers achieve new levels of performance through smart orchestration. A pioneer in the industry, R1 created the first Healthcare Revenue Operating System: a modular, intelligent platform that integrates automation, AI, and human expertise to strengthen the entire revenue cycle. With more than 20 years of experience, R1 partners with 1,000 providers, including 95 of the top 100 U.S. health systems, and handles over 270 million payer transactions annually. This scale provides unmatched operational insight to help healthcare organizations unlock greater long‑term value. To learn more, visit: https://www.r1rcm.com .