Security Engineer

Open Loop was co-founded by CEO, Dr. Jon Lensing, and COO, Christian Williams, with the vision to bring care anywhere. Our telehealth support solutions are thoughtfully designed to streamline and simplify go-to-market care delivery for companies offering meaningful virtual support to patients across an expansive array of specialties, in all 50 states.

Open Loop’s mission is to bring care anywhere by powering telehealth solutions  deliver white-labeled clinical and operational infrastructure that helps companies scale virtual care across all 50 states: telehealth delivery, clinician staffing, licensing, payer coverage, and revenue cycle management. Our clients run on our platform under their own brand, which means their patients’ trust depends on how well we protect it.

We operate in a regulated environment (HIPAA, HITRUST, SOC
2) with protected health information in scope across much of the business — security here is not a checkbox, it is part of how we deliver care.

We’re hiring a Staff Security Engineer to own and mature the security of the systems our workforce depends on every day, with a focus on endpoints and email. You’ll be a hands‑on generalist with deep engineering expertise in those two areas, and you’ll set the technical bar for them across Open Loop and our subsidiaries.

Security Architecture & Engineering (SAE) builds and owns the security platform; our Security Operations team consumes it for detection and response. In this role you engineer, deploy, and harden the controls, and you partner closely with Sec Ops so the telemetry and tooling you build actually serve their mission.

At the Staff level, your impact goes beyond your own tickets. You’ll build controls that hold up for years, write the standards and baselines other engineers follow, and raise the technical bar of the team around you.

• Own the engineering of security controls for our macOS and Windows fleet, including device management (MDM), disk encryption, patch compliance, and local admin controls.

• Engineer MDM and mobile application management (MAM) policies that protect company and PHI data on both managed devices and BYOD, including app protection, conditional access, and selective wipe.

• Deploy and manage an enterprise browser to secure SaaS and web access, including data controls (copy/paste, download, print), session policies, and extension management.

• Build, apply, and continuously measure CIS Benchmark baselines across the fleet. Track drift, manage documented exceptions, and produce fleet-level evidence that holds up to HITRUST and SOC 2 auditors.

• Drive application control and least‑privilege on endpoints without breaking the clinicians and operators who depend on them.

• Own email security for our Google Workspace environment: SPF, DKIM, DMARC enforcement, phishing and BEC defenses, attachment and link protection, and data loss prevention for PHI.

• Tune controls to reduce real risk and false positives, and partner with Sec Ops on phishing triage workflows.

• Write security standards, configuration baselines, and runbooks that others can follow without you in the room.

• Implement and validate controls identified through threat modeling and security reviews.

• Contribute to audit readiness by mapping controls to HITRUST and SOC 2 requirements and owning evidence for your domains.

• Automate repetitive work. If you’ve done it twice by hand, script it.

• Mentor engineers on SAE and adjacent teams, and serve as an escalation point during incidents in your domains.

• Partner with IT, Engineering, Compliance, and Sec Ops, translating security risk into business and operational terms.

• Other duties as assigned.

You treat patient…