Cybersecurity Engineer II

Job  

# Positions: 1

Job Location:

US

Telecommute:
Regional Remote Position

FT/PT:
Full-Time

Category:
Information Technology

With a mantra of Empowering Human Potential, Hanger, Inc. is the world's premier provider of orthotic and prosthetic (O&P) services and products, offering the most advanced O&P solutions, clinically differentiated programs and unsurpassed customer service. Hanger's Patient Care segment is the largest owner and operator of O&P patient care clinics nationwide. Through its Products & Services segment, Hanger distributes branded and private label O&P devices, products and components, and provides rehabilitative solutions to the broader market.

With 160 years of clinical excellence and innovation, Hanger's vision is to lead the orthotic and prosthetic markets by providing superior patient care, outcomes, services and value. Collectively, Hanger employees touch thousands of lives each day, helping people achieve new levels of mobility and freedom.

The Cybersecurity Engineer II is responsible for assessing, securing, and integrating technology environments associated with mergers and acquisitions across Hanger's national network of patient care clinics and business operations. Working across the full deal lifecycle, from pre-close due diligence through Day 1 stabilization and post-close integration, this role performs hands‑on security engineering, technical assessments, compromise assessment and threat hunting, remediation, and implementation of enterprise security controls across acquired environments.

The Cybersecurity Engineer II partners with Hanger's corporate Security leadership team to translate technical findings into clear, business-focused risk reporting that informs deal decisions and integration priorities, and helps ensure that protected health information (PHI) and critical clinical and business systems in acquired companies are brought up to enterprise security and compliance standards.

Due Diligence and Assessment

• Pre-Close Due Diligence: Support pre-close security due diligence by reviewing target-company security documentation, questionnaire responses, incident and breach history, and external attack surface to identify deal-impacting risks and inform integration planning.
• Technical Assessments: Perform technical security assessments across on-premises, cloud, and hybrid environments.
• Compromise Assessment and Threat Hunting: Conduct or coordinate compromise assessments and threat hunting in acquired environments before network interconnection, looking for indicators of compromise, persistence mechanisms, unauthorized or stale accounts, and anomalous authentication activity.
• Vulnerability Assessment: Conduct vulnerability assessments, coordinate penetration testing of acquired systems, and drive remediation of identified security gaps and misconfigurations.
• Application and Data Review: Review acquired-company application portfolios to identify business-critical systems (including electronic health record, practice management, and billing platforms), data sensitivity and PHI locations, authentication methods, integrations, and security risks.
• Third-Party Risk: Inventory and assess acquired-company vendors, business associates, and sub-processors, and identify gaps in Business Associate Agreements and security-related contract terms.

Integration and Remediation

• Day 1 Controls: Define and implement Day 1 security controls for acquired entities, including enforced multifactor authentication, privileged access cleanup, endpoint protection, email security, and centralized logging.
• Security Tooling: Deploy, configure, and support enterprise security tooling and controls within acquired environments, including endpoint detection and response, SIEM, identity governance, email security, secure access, and backup platforms.
• Cloud Hardening: Perform hands-on security hardening of cloud environments, including identity, access controls, network exposure, logging, configuration, and remediation of identified weaknesses.
• Network Segmentation: Design and validate secure interconnection and segmentation between acquired and enterprise networks, including separation of clinical, corporate, and vendor zones.
• Platform Integration: Integrate acquired environments with enterprise security platforms, controls, and processes, including security monitoring, vulnerability management, incident response, and identity lifecycle management.
• Monitoring and Incident…