Lead Security Engineer

Location: Remote Position

Hiring Range: $ - $

The Lead Security Engineer provides hands‑on technical leadership for American Oncology Network’s enterprise security program, overseeing security tools, configurations, monitoring, vulnerability management, incident response, and managed security service partners across a distributed healthcare environment. Reporting to the Director of IT Security, this role leads and develops a team of three security staff, strengthens the protection of patient information and clinical operations, and drives consistent security practices across AON locations.

KPA 1:
Security Engineering, Tools and Infrastructure

• Own and administer the security technology stack, including SIEM/SOAR, endpoint protection, email security, privileged access management, and secure network access.
• Maintain and optimize Rapid7 InsightIDR, InsightVM and Insight Connect, Bitdefender Gravity Zone, Mimecast, Delinea Secret Server, and Cato security configurations and coverage.
• Secure Microsoft 365, Azure and other cloud/SaaS environments by establishing configuration baselines and monitoring security posture.
• Manage security tool licensing, coverage, and renewal inputs to maintain appropriate protection and cost‑effective utilization.

KPA 2:
Threat Detection, Incident Response and Vulnerability Management

• Lead security event triage and incident investigations in partnership with the managed detection and response provider; coordinate containment, recovery, and post‑incident reviews.
• Oversee vulnerability scanning, prioritization, remediation, and patch management across endpoints, servers, cloud platforms, and network infrastructure.
• Document risks associated with legacy systems and validate compensating controls where timely remediation is not feasible.
• Develop response runbooks, technical standards, and repeatable procedures to support consistent security operations.

KPA 3:
Identity, Access and Security Risk Compliance

• Strengthen identity and access security through multifactor authentication, conditional access, privileged access management, joiner/mover/leaver controls, and periodic access reviews.
• Coordinate annual HIPAA- and NIST‑aligned security risk assessments, vulnerability assessments, and penetration tests with external assessment partners.
• Track and drive remediation of assessment findings and security gaps, communicating technical risks and priorities to stakeholders.
• Assess security risks arising from third‑party vendors, integrations, newly onboarded sites, and acquired practices.

KPA 4:
Vendor and Managed Security Partner Oversight

• Serve as the technical lead and primary day‑to‑day accountability point for managed service and security partners, including ATG and Rapid7 MDR.
• Validate provider deliverables, service quality, investigation work, and adherence to contractual service‑level agreements.
• Escalate gaps and coordinate corrective action with internal IT stakeholders and external partners.
• Promote clear documentation, ownership, and communication across security operations and partner workflows.

KPA 5:
Team Leadership and Operational Improvement

• Lead, mentor, and develop security staff by establishing priorities, reviewing deliverable quality, and building technical capabilities.
• Provide practical guidance during complex security investigations, remediation activities, and operational issues.
• Identify opportunities to improve security workflows through Power Shell, Python, and other scripting or automation methods.
• Communicate security risks, operational priorities, and remediation progress clearly to nontechnical leaders and clinical stakeholders.

Education

• Bachelor’s degree in information security, Computer Science or related…