IT Security Engineer

Overview

Well Street Urgent Care is seeking an experienced IT Security Engineer to support and advance the organization s cybersecurity program within a regulated healthcare environment. This role is responsible for the engineering, operation, and continuous improvement of security controls across Well Street s hybrid cloud and on-premises infrastructure. In addition to core security engineering and operations, this role supports the organization s security awareness and education efforts and performs other security-related duties as assigned to meet evolving organizational and regulatory needs.

• Engineer, operate, and continuously improve security controls across Well Street s enterprise environment, including endpoint, identity, network, and cloud security platforms.
• Maintain reliable security integrations, logging, and telemetry to support detection, response, and audit visibility.
• Partner with the SOC to validate alerts and coordinate response while retaining internal ownership of security decisions.
• Participate in on-call response for confirmed or high-severity security incidents.
• Investigate and coordinate response to security incidents in accordance with documented procedures, balancing containment, business impact, and recovery.
• Maintain and improve incident response playbooks for common healthcare threat scenarios, including phishing, ransomware, unauthorized access, and data exposure.
• Document incidents and contribute to post-incident reviews and continuous improvement efforts.
• Identify security risks, control gaps, and improvement opportunities across infrastructure, identity, endpoints, and cloud services.
• Recommend and implement practical, risk-based security improvements aligned with clinical and business operations.
• Support vulnerability management and remediation coordination with IT Operations.
• Support the organization s security awareness and education program, including phishing simulations, targeted training, and user education aligned with HIPAA and HITRUST requirements.

• Support ongoing HIPAA and HITRUST sustainment activities, including control documentation, evidence management, and audit readiness.
• Partner with Compliance, Privacy, HR, and internal stakeholders during assessments, audits, and reviews to ensure security control remains accurate and defensible.

• Collaborate with IT Operations, Privacy, Compliance, HR, and leadership to integrate security requirements into operational workflows.
• Communicate security risks, recommendations, and incident lessons learned clearly to technical and non-technical audiences.
• Perform all other duties assigned to support evolving organizational and regulatory needs.

Performance in this role is evaluated based on the individual s ability to protect patient data, support uninterrupted clinical operations, and sustain Well Street s HIPAA and HITRUST security posture. Success is demonstrated through reliable execution of security responsibilities, sound judgment during incidents, effective risk identification and mitigation, and consistent collaboration with clinical, operational, and compliance stakeholders. The IT Security Engineer is expected to balance strong security controls with the practical needs of a healthcare environment, contribute to audit readiness and compliance sustainment, and adapt to evolving threats, technologies, and organizational priorities while maintaining trust and accountability.

Execution & Reliability

• Completes assigned security tasks accurately and within expected time frames.
• Consistently follows documented security processes and escalation procedures.
• Produces dependable, repeatable security outcomes with minimal rework.
• Responds appropriately to security incidents based on severity and business impact.
• Apply incident response playbooks while exercising sound judgment when conditions require flexibility.
• Document incident activities, findings, and lessons learned clearly and thoroughly.

Risk Identification & Mitigation

• Proactively identifies security weaknesses or improvement opportunities.
• Communicates risk in…