Senior Corporate IT Security Engineer

Description

The company uses de-identified, real-world patient data, algorithms and clinical experience to map the US healthcare system, helping partners track patient behavior, treatment patterns and gaps in care.

Because the company handles sensitive healthcare data, a sound corporate security setup matters to its customers.

This role sits in IT and works with the Security team, which runs security monitoring, cloud and production security, and the company incident response program.

You will be a senior individual contributor with no team to manage. At least 70% of the work is hands-on: configuring, scripting, investigating and remediating. The rest covers corporate incident response, documentation and working with other functions.

Your scope is corporate identity, devices, endpoints, internal networks, workforce SaaS and AI tools, and the related workforce risk.

Responsibilities

• Harden identity and access in the enterprise identity provider and productivity suite: phishing-resistant MFA, consistent SSO, session and sign-on policies, least-privilege admin roles, and oversight of service and non-human accounts.
• Tie device trust to access by using posture tooling with the MDM and EDR across mixed macOS and Windows devices, so business system access depends on device health.
• Keep joiner-mover-leaver processes sound: every app provisioned through the identity provider, no out-of-band accounts, prompt and verified removal, tracked offboarding exceptions, and audit-ready access reviews.
• Secure workforce SaaS with export and API controls, session protections, OAuth and connected-app governance, audit-log monitoring, and detection of shadow IT and configuration drift.
• Act as Incident Commander for incidents confined to the corporate environment, following the company incident response process for severity and the incident record. Security leads once production, cloud or customer data is involved, and you support with IT expertise. Coordinate IT, Legal, Compliance and Communications, lead investigation and remediation, and run blameless post-incident reviews with tracked follow-ups.
• Set guardrails for workforce AI: approved-tool standards, SSO and domain capture, RBAC, retention, logging and access reviews for AI tools, connectors and integrations, with new tools passing through the existing vendor security review. Security keeps ownership of AI in products and engineering workflows.
• Within 90 days, deliver a current-state assessment of corporate identity, devices and SaaS as a sequenced remediation backlog with named owners, fixing the highest risks first.
• Within 12 months, have business-critical app access tied to device posture, privileged access on phishing-resistant MFA, offboarding SLAs met, and access reviews completed on time with clean evidence.
• Within 12 months, have least-privilege SaaS export and API rights, a governed OAuth inventory, corporate secrets kept out of SaaS and collaboration tools, and new detection use cases delivered with Security.
• Within 12 months, have IT alerts with defined owners, at least two tabletop exercises with IT, Security, Legal and Communications, every corporate incident closed with a post-incident review and tracked follow-ups, and shadow IT, risky OAuth and workforce AI governance that enables the business.

Requirements

• 6, 8+ years in corporate, IT or security engineering or operations, with 4+ years of hands-on corporate control engineering at a cloud-native or SaaS company. No people management experience needed.
• Deep hands-on work with an enterprise identity provider and its protocols (SAML, OIDC, OAuth 2.0, SCIM), covering sign-on and session policies, device assurance or conditional access, and lifecycle automation.
• Hands-on device trust, MDM and EDR on macOS and Windows, including rolling out posture-based access without disrupting productivity.
• Hardening experience with productivity suites and major SaaS platforms: admin roles, export and API permissions, OAuth app governance, and audit logging.
• Defining detection use cases and writing or tuning detection rules with a security operations team.
• Served as incident commander or lead responder on real incidents, made containment calls under pressure, and run post-incident reviews that drove real change.
• Production-quality Python or similar scripting, and experience integrating security tools through APIs.
• Experience producing control evidence for SOC 2 and other audits.
• Clear writing and executive communication, turning technical risk into business impact and decisions, and influencing IT, Engineering, Security, Legal, People and Procurement. Experience partnering with Legal and Compliance on investigations, audits or regulatory reviews.
• Required: use AI in your own work for triage, investigation, documentation and automation, with clear human accountability for every decision.
• Nice to have: experience in healthcare, life sciences or another regulated or sensitive data environment.
• Nice to have: experience at a high-growth company in the Series C to E or pre-IPO stage.
• Nice to have: identity workflow automation, identity threat detection or device-assurance integrations.
• Nice to have: experience with SSPM or compliance-automation platforms.
• Nice to have: insider-risk or DLP programs, or digital forensics.
• Nice to have: evaluating and implementing enterprise security vendors.
• Nice to have: certifications such as GCIH or CISSP.

Conditions

Hybrid work model with hubs in San Francisco, New York City and Chicago. Some roles can be done from anywhere in the country, some are tied to a specific region, and some are based near a hub. Hub-based staff follow in-office rhythms alongside flexibility, and expectations are set before you join.

Base pay of $173,000 - $215,000 USD in the San Francisco Bay Area and New York City, and $150,000 - $185,000 USD in all other US locations.

The range is the minimum and maximum base pay the company reasonably expects to pay in the US. Pay depends on skills, experience, location, training and certifications, business needs and market demand.

Benefits

• Possible performance-based bonus, at the company's sole discretion and under a written agreement or plan.
• Possible equity awards.
• Comprehensive health, dental and vision insurance.
• Flexible time off and holidays.
• 401(k) with company match.
• Disability and life insurance.
• Leaves of absence under applicable state and local laws and company policy.