Sr. Infrastructure Security Engineer

NOW Health Group INC is looking for a Senior Infrastructure Security Engineer to strengthen the security posture of its on-premises Windows and Active Directory environment and the Microsoft 365 tenant. This onsite role in Bloomingdale, IL focuses on practical hardening, identity security improvements, and resilience planning, with close partnership across IT Security, networking, and IT.

Salary: USD 151,000 to 197,000 per year.
Experience: 5+ years required.

In this position, you’ll implement and maintain secure configuration standards across key infrastructure and identity platforms, using CIS benchmarks and industry best practices. You’ll also help drive ongoing security posture assessments and remediation, with leadership on initiatives that reduce risk across privileged access, protocol exposure, and account hygiene.

• Implement and maintain secure configurations across Windows Server
  , Active Directory
  , and Microsoft 365 using CIS benchmarks and best practices.
• Conduct regular security posture assessments and remediate gaps.
• Lead initiatives including Tier 0/1/2 administration model and removal of insecure protocols
  .
• Drive LAPS implementation and privileged credential protection.
• Perform AD hygiene and security reviews, including privileged group membership audits
  , AD ACL and delegation reviews
  , service account inventory
  , and cleanup of stale objects
  .
• Support PAM and least privilege models.
• Design and maintain Conditional Access policies and MFA enforcement
  .
• Improve tenant posture through Secure Score optimization
  , plus identity protection and sign-in risk policies
  .
• Manage and audit app registrations
  , enterprise apps
  , and OAuth permissions
  , including guest access and external collaboration settings.
• Support configuration and tuning of Microsoft Purview DLP
  , sensitivity labels, and information protection controls in partnership with IT Security and compliance stakeholders.

You’ll lead patching and vulnerability remediation across infrastructure and lifecycle boundaries, and help ensure recovery readiness through testing and robust DR practices.

• Lead infrastructure patching strategy with system owners, IT Security, and Operations, including Windows Server updates (including emergency CVE patching),
  hypervisor and firmware updates
  , and third-party application patching
  .
• Track and remediate vulnerability scan findings
  .
• Coordinate end-of-life remediation (OS, hardware, platforms).
• Ensure backups are successful and recoverable
  , including restore/recovery testing and DR exercises.
• Validate immutable and air-gapped backup strategies
  .
• Maintain DR runbooks aligned to RPO/RTO goals
  .
• Review and respond to infrastructure and identity security alerts and elevate to IT Security as appropriate.
• Tune alerts to reduce noise and increase actionable signals.
• Partner with IT Security to investigate infrastructure and identity-related security events, support containment/remediation, and perform root cause analysis.
• Partner with Network Engineering and IT Security to review firewall rules, identify overly permissive access, and support remediation using least privilege and segmentation principles.

• Reduce endpoint risk through removal of local admin rights and hardening endpoint configurations
  .
• Define remediation plans with risk-based prioritization
  .
• Create and maintain security-focused runbooks and procedures.
• Conduct quarterly access reviews and participate in tabletop incident response exercises.
• Help establish repeatable security operational processes, developing automation where possible.
• Act as the security subject matter expert for the infrastructure team, providing guidance and hands-on support…