Job Description:

• Lead investigation and response for complex security incidents, including ransomware, business email compromise, insider threats, and suspected PHI breaches
• Develop and tune detection use cases, correlation rules, and playbooks in SIEM, EDR, and SOAR platforms
• Conduct threat hunting and threat intelligence analysis focused on healthcare-targeted threat actors
• Direct breach assessment and coordinate notification activities with Privacy, Legal, and Compliance under HIPAA and state breach laws
• Perform post-incident reviews and drive remediation of root causes
• Perform and oversee security risk assessments aligned to HIPAA Security Rule, HITRUST CSF, NIST CSF, NIST 800-53, and SOC 2
• Support internal and external audits, client security questionnaires, and payer/provider due diligence
• Assess third-party and vendor risk
• Maintain risk registers and report risk posture to senior leadership
• Review architecture and design for claims adjudication, EDI, eligibility, provider portals, and member-facing applications
• Advise on cloud security, identity and access management, encryption, network segmentation, and data loss prevention
• Embed security into the SDLC through threat modeling, secure code review, and vulnerability management
• Ensure appropriate controls for data in transit and at rest, including HL7, FHIR, and API-based data exchange
• Safeguard claims data against fraud, unauthorized access, and exfiltration
• Monitor privileged and role-based access to claims platforms, data warehouses, and analytics environments
• Collaborate with Privacy and Compliance on minimum-necessary access, data retention, and de-identification practices
• Serve as technical lead and escalation point for Tier 2 and Tier 3 analysts
• Mentor junior and mid-level staff and contribute to training and tabletop exercises
• Communicate complex technical risks to executive and non-technical stakeholders

Requirements:

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or equivalent experience
• 8+ years of progressive information security experience
• 3+ years of experience in healthcare, health insurance, or claims processing
• Hands-on experience with SIEM (Splunk, Sentinel, QRadar), EDR (CrowdStrike, Defender, SentinelOne), and vulnerability management tools
• Deep knowledge of HIPAA/HITECH, PHI handling requirements, and breach response obligations
• Demonstrated experience leading incident response in a regulated environment
• Working knowledge of cloud security, IAM, network security, and encryption
• Familiarity with healthcare data standards and workflows (EDI X12, HL7, FHIR) and claims lifecycle processes
• Strong written and verbal communication skills
• Preferred: CISSP, CISM, CCSP, GCIH, GCIA, GCFA, HCISPP, or CISA certifications
• Preferred: Experience with HITRUST, SOC 2, or PCI DSS assessments
• Preferred: Experience with payer, TPA, PBM, or healthcare clearinghouse environments
• Preferred: Familiarity with MITRE ATT&CK, Zero Trust, and scripting for automation (Python, PowerShell)
• Preferred: Knowledge of healthcare fraud, waste, and abuse (FWA) patterns and related data analytics
• Preferred: Experience with medical device or IoMT security

Benefits:

• Multiple health and dental plans with nationally recognized networks
• Vision benefits
• Total wellness program
• Employee assistance program for you and your family
• Retirement savings plans
• Company-paid disability and life insurance
• Pre-tax savings opportunities (HSA and/or FSA)
• Professional development offerings
• Opportunities for remote work
• Generous paid-time-off program
• Flexible scheduling to accommodate unexpected events