Senior IT Security Engineer

What you'll do

• Plan and execute penetration tests across internal and external infrastructure, networks, and web and mobile applications.
• Perform manual and tool-assisted application security testing integrated into the SDLC, including gray-box testing.
• Test cloud configurations, IAM, and workload-level exposures across AWS, Azure, and GCP environments.
• Simulate real-world adversary techniques against production and pre-production systems in coordination with engineering teams.
• Build and maintain a security toolkit by writing custom scripts and tools to close coverage gaps.
• Document findings with risk ratings, reproduction steps, and remediation guidance for engineering and executive stakeholders.
• Support security testing tied to HIPAA, SOC 2, and PCI DSS compliance assessments and audits.
• Track emerging attack techniques and threat intelligence relevant to healthcare and revenue cycle technology.

What we're looking for

• 5+ years of hands-on experience in penetration testing or offensive security across infrastructure, networks, and applications.
• At least one recognized offensive security certification such as OSCP, GPEN, GWAPT, GXPN, CEH, or equivalent.
• Practical experience testing in multiple cloud environments including AWS, Azure, and/or GCP.
• Working knowledge of MITRE ATT&CK, the OWASP Testing Guide, and PTES methodologies.
• Fluency with open-source and commercial security tools like Burp Suite, Nmap, and Metasploit.
• Scripting or automation ability in Python, PowerShell, or Bash to build custom tooling.
• Experience operating in environments subject to HIPAA, SOC 2, and/or PCI DSS.
• Advanced certifications such as OSWE, OSCE/OSEE, GXPN, CISSP, or CCSP (preferred).