Cyber Security Manager

Tuesday Health

1d • Remote

About The Position

The Security Manager safeguards the confidentiality, integrity, and availability of our systems, data, facilities, and medical operations. This role leads security governance, risk management, and compliance efforts; oversees security operations and incident response; and partners with IT, Clinical Operations, Privacy, and Compliance to ensure our organization meets regulatory requirements (e.g., HIPAA Security Rule) and industry frameworks (e.g., SOC 2, HITRUST). The Security Manager is accountable for proactive risk reduction, rapid detection and response to threats, and building a strong security culture across the company.
You will work closely with our engineering team and third-party security partners to define secure coding standards, validate security controls, and coordinate penetration testing and remediation for a modern cloud-native stack built on Azure, .NET Minimal APIs, Blazor WASM, MAUI, and PostgreSQL.

Requirements

• Bachelor’s degree in Information Security, Computer Science, or related field—or equivalent experience.
• 5–8+ years in security roles with 2–3+ years leading security operations or GRC initiatives.
• Hands-on experience with cloud security
• Working knowledge of HIPAA Security Rule, PHI/PII handling, SOC 2 Type II, and incident response practices.
• Hands-on experience with Azure security services (Defender for Cloud, Sentinel, Key Vault, RBAC).
• Familiarity with secure development practices for .NET, Blazor WASM, MAUI, and PostgreSQL (oversight, not coding).
• Proven ability to run risk assessments, develop policies, and manage audits.
• Strong communication skills; ability to influence cross-functional leaders and train non-technical audiences.

Responsibilities

• Lead the enterprise security program aligned to HIPAA Security Rule, SOC 2 Type II, HITRUST CSF, and internal policies.
• Own risk assessments, risk register, treatment plans, and executive reporting.
• Maintain security policies and standards (access control, encryption, vendor risk, vulnerability management, incident response, acceptable use, AI/GenAI usage).
• Coordinate audits, evidence collection, corrective actions, and ongoing compliance monitoring.
• Oversee daily security operations: SIEM monitoring, EDR, vulnerability scanning, patch management, and email security/anti-phishing.
• Implement and tune detection rules, playbooks, and escalation paths; manage MDR/SOC vendors as applicable.
• Ensure Azure security posture through Defender for Cloud, Sentinel, and RBAC enforcement.
• Validate security configurations for .NET APIs, Blazor WASM, MAUI apps, and PostgreSQL—working with engineering to confirm adherence to secure coding guidelines.
• Collaborate with third-party penetration testing vendors: schedule tests, review findings, and track remediation.
• Define and enforce secure coding standards for .NET, Blazor, and MAUI applications.
• Ensure CI/CD pipelines include security checks (SAST, DAST, dependency scanning).
• Provide oversight for infrastructure-as-code security (ARM/Bicep templates) and zero-trust principles.
• Advise engineering on OWASP best practices and secure API design.
• Lead incident response lifecycle (prepare, detect, contain, eradicate, recover, lessons learned) with documented runbooks.
• Coordinate with Privacy/Legal on reportable events; align to HIPAA breach requirements and internal incident procedures.
• Maintain and test Business Continuity and Disaster Recovery plans; run tabletop exercises at least twice annually.
• Enforce least-privilege, role-based access control (RBAC), and periodic access reviews for PHI/PII and critical systems.
• Manage Entra ID, privileged access management (PAM).
• Implement data loss prevention (DLP) and encryption standards (in transit and at rest), including key management in Azure Key Vault.
• Oversee third-party risk management for all vendors handling PHI, PII, or critical systems.
• Conduct security due diligence, including reviewing SOC 2/ISO certifications, penetration test results, and security questionnaires.
• Ensure Business Associate Agreements (BAAs) are in place for vendors processing PHI and verify compliance with HIPAA Security Rule.
• Maintain a vendor risk register and track remediation of identified gaps.
• Monitor vendor adherence to contractual security obligations, including data residency, retention, and model training restrictions for AI tools.
• Collaborate with Procurement and Legal to include security requirements in contracts and enforce breach notification timelines.
• Periodically reassess vendor security posture and update risk ratings based on audits or incidents.

Benefits

• Competitive compensation, reflecting our commitment to attracting, retaining, and motivating the best talent in the industry
• Comprehensive benefits including medical, dental, vision, and life insurance, paid time off and holidays, employer 401(K) match, etc.
• Remote work with multiple onsite sessions each year to maximize collaboration and team building
• A dynamic and inclusive team environment where you can lean on your teammates, offer candid feedback, bring your true self to work each day, and deliver tremendous impact while having fun along the way
• Meaningful work each day; we care deeply about our mission, our patients, and each other

What This Job Offers

• Job Type: Full-time
• Career Level: Manager