Lead Security Engineer

American Oncology Network•Urbana, IL

3d•$104,200 - $155,800•Remote

About The Position

The Lead Security Engineer provides hands-on technical leadership for American Oncology Network’s enterprise security program across a distributed healthcare environment. The role oversees security tools and configurations, monitoring, vulnerability management, incident response, and managed security service partners. It leads and develops a team of three security staff, strengthens protection of patient information and clinical operations, and drives consistent security practices across AON locations. The position reports to the Director of IT Security. The role owns and administers the security technology stack, including SIEM/SOAR, endpoint protection, email security, privileged access management, and secure network access. It maintains and optimizes Rapid7 InsightIDR, InsightVM and InsightConnect, Bitdefender GravityZone, Mimecast, Delinea Secret Server, and Cato configurations and coverage, and secures Microsoft 365, Azure, and other cloud/SaaS environments. The Lead Security Engineer leads security event triage and incident investigations with the managed detection and response provider, coordinates containment and recovery, oversees vulnerability remediation and patch management, and develops response runbooks and technical standards. The position also strengthens identity and access controls, coordinates HIPAA- and NIST-aligned assessments, tracks findings, and evaluates risks from vendors, integrations, new sites, and acquired practices. As technical lead for managed service and security partners, the role validates provider deliverables and service quality, monitors contractual service-level agreements, and coordinates corrective action. It mentors security staff, improves workflows through scripting and automation, and communicates security risks and priorities to nontechnical leaders and clinical stakeholders. The position is remote, with 0–25% travel.

Requirements

At least 8 years of information security or security engineering experience, including hands-on operation of production security tools.
At least 2 years leading or mentoring security staff.
Experience overseeing MSP, MSSP, or MDR providers; leading security investigations; and administering SIEM/XDR and vulnerability management technologies.
Knowledge of HIPAA, HITECH, and healthcare security frameworks such as HITRUST and NIST CSF.
Practical experience with endpoint, email, network, cloud, and privileged access security, including Microsoft 365, Azure, Entra ID, Rapid7 InsightIDR, and InsightVM.
Ability to perform the essential duties satisfactorily, including the listed knowledge, skills, and abilities.
Physical requirements include sitting, keyboard use, minimal lifting, and long screen exposure.
Cognitive requirements include time management, effective written and verbal communication, and policy interpretation.
The role requires a home office setup and minimal external environmental exposure.

Nice To Haves

Bachelor’s degree in information security, computer science, or a related field.
Healthcare or multisite provider experience.
EHR familiarity, such as OncoEMR.
M&A or new-site security integration experience.
CISSP, GIAC (GCIH, GCIA, GSEC), CCSP, or Microsoft security certifications.

Responsibilities

Own and administer the security technology stack, including SIEM/SOAR, endpoint protection, email security, privileged access management, and secure network access.
Maintain and optimize Rapid7 InsightIDR, InsightVM and InsightConnect, Bitdefender GravityZone, Mimecast, Delinea Secret Server, and Cato security configurations and coverage.
Secure Microsoft 365, Azure, and other cloud/SaaS environments by establishing configuration baselines and monitoring security posture.
Manage security tool licensing, coverage, and renewal inputs for appropriate protection and cost-effective utilization.
Lead security event triage and incident investigations with the managed detection and response provider; coordinate containment, recovery, and post-incident reviews.
Oversee vulnerability scanning, prioritization, remediation, and patch management across endpoints, servers, cloud platforms, and network infrastructure.
Document risks associated with legacy systems and validate compensating controls when timely remediation is not feasible.
Develop incident response runbooks, technical standards, and repeatable procedures for consistent security operations.
Strengthen identity and access security through multifactor authentication, conditional access, privileged access management, joiner/mover/leaver controls, and periodic access reviews.
Coordinate annual HIPAA- and NIST-aligned security risk assessments, vulnerability assessments, and penetration tests with external assessment partners.
Track and drive remediation of assessment findings and security gaps, communicating technical risks and priorities to stakeholders.
Assess security risks from third-party vendors, integrations, newly onboarded sites, and acquired practices.
Act as the technical lead and primary day-to-day accountability point for managed service and security partners, including ATG and Rapid7 MDR.
Validate provider deliverables, service quality, investigation work, and adherence to contractual service-level agreements.
Escalate gaps and coordinate corrective action with internal IT stakeholders and external partners.
Promote clear documentation, ownership, and communication across security operations and partner workflows.
Lead, mentor, and develop security staff by establishing priorities, reviewing deliverable quality, and building technical capabilities.
Provide practical guidance during complex security investigations, remediation activities, and operational issues.
Identify opportunities to improve security workflows using PowerShell, Python, and other scripting or automation methods.
Communicate security risks, operational priorities, and remediation progress clearly to nontechnical leaders and clinical stakeholders.