Platform Software Engineer

OneOncology

2d•Remote

About The Position

OneOncology is seeking a Platform Software Engineer to build, operate, and enhance the Microsoft Azure foundation that supports its engineering teams and applications. Reporting to the Manager, Software & AI Engineering, this hands-on role focuses on automating infrastructure, strengthening a HIPAA-regulated environment, and developing efficient processes for compliance evidence collection in support of OneOncology’s HITRUST CSF certification. The engineer will work with substantial autonomy on a small team, contributing to technical design and implementation and owning solutions end to end. This includes developing and maintaining Terraform modules, supporting technical controls and compliance requirements, and responding to audits. The position is full-time and remote within the United States. Employees located in the Nashville, Tennessee area may choose to work from the Nashville office.

Requirements

Bachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent work experience.
High school diploma or GED.
At least 5 years of experience in platform, infrastructure, DevOps, cloud, or site reliability engineering.
At least 3 years of hands-on Microsoft Azure experience across compute, networking, identity, storage, and monitoring.
Demonstrated Infrastructure as Code experience with Terraform, Bicep, or ARM templates, including module design and state management.
Experience designing and maintaining CI/CD pipelines, ideally in Azure DevOps or GitHub Actions.
Strong scripting skills in PowerShell, Bash, or Python.
Working knowledge of at least one healthcare or security compliance framework—HITRUST CSF, HIPAA/HITECH, SOC 2, or NIST—and practical experience enforcing controls in a cloud environment.
Ability to operate autonomously on a small team and own problems end to end.
Ability to take ambiguous problems from design through production with limited oversight.
Ability to design systems and explain the tradeoffs behind decisions.
Clear written and verbal communication with technical and non-technical partners.
Generalist range and comfort operating on a small, fast-moving engineering team.
Sound handling of protected health information and a security-first mindset.
Attendance is an essential job function.

Nice To Haves

Direct experience supporting a HITRUST CSF validated assessment (e1, i1, or r2) or equivalent audit, including evidence preparation.
Experience in healthcare technology or another HIPAA-regulated environment.
Kubernetes/AKS and container security experience.
SIEM experience with Microsoft Sentinel and familiarity with compliance automation tooling such as MyCSF, Vanta, or Drata.
Certifications such as AZ-104, AZ-400, AZ-500, CKA/CKS, CISSP, or HITRUST CCSFP.
Familiarity with AI-assisted engineering tools and how to adopt them safely in a regulated environment.

Responsibilities

Design, provision, and operate Azure infrastructure—including App Service, AKS, Functions, networking, storage, and databases—using Terraform or Bicep, with disciplined module design, state management, and peer review.
Build and maintain Azure DevOps CI/CD pipelines for secure, repeatable infrastructure and application deployments with appropriate change management.
Automate routine operational tasks and workflows using PowerShell, Bash, or Python.
Own platform and infrastructure controls supporting OneOncology’s HITRUST CSF certification, partnering with Security and Compliance on scoping, readiness, remediation, and assessment.
Build and maintain secure configuration baselines, reusable infrastructure modules, and automated control monitoring and evidence collection using tools such as Azure Policy and Microsoft Defender for Cloud.
Extend controls and tooling to newly acquired practices and environments.
Administer identity and access controls through Microsoft Entra ID, RBAC, Privileged Identity Management, Conditional Access, and MFA; conduct access reviews and enforce least-privilege and segregation-of-duties principles.
Manage secrets, certificates, and encryption keys in Azure Key Vault, including rotation and lifecycle management.
Maintain centralized logging, monitoring, detections, alerts, and dashboards using Azure Monitor, Log Analytics, and Microsoft Sentinel, including appropriate audit retention and immutability requirements.
Participate in incident response and the on-call rotation.
Run authenticated vulnerability scanning and drive risk-based remediation within agreed SLAs.
Manage patching across cloud and server workloads with minimal disruption.
Maintain backup and disaster recovery capabilities and test recovery against defined RTO and RPO targets.
Develop self-service tooling, templates, runbooks, and documentation that help application engineers work within established security and compliance guardrails.
Perform additional responsibilities as assigned to support OneOncology’s mission.