Security Engineer II - Cyber Operations

Endeavor Health•Skokie, IL

4d•Hybrid

About The Position

As a Security Engineer II in Cyber Operations at Endeavor Health, you will primarily support the organization’s Data Loss Prevention (DLP) program and strengthen protection of sensitive information across email, cloud, and endpoint environments. You will support DLP capabilities, including Microsoft Purview and endpoint DLP, through alert monitoring and investigation, policy administration and tuning, coordination with users and business units, documentation, and follow-up. The role also supports Insider Risk and related data-protection monitoring, including work involving HIPAA, PCI, and other sensitive-data requirements. You will develop and improve DLP procedures, case-management workflows, automation, and metrics to support timely, consistent investigations and demonstrate the effectiveness of DLP controls. DLP is the primary focus, with additional Cyber Operations responsibilities as assigned, including security incident response, administration of other security technologies, compliance activities, and cybersecurity projects. This hybrid role includes a 24/7 on-call support rotation and requires sound judgment, technical expertise, project management, and clear communication with technical and business partners. You will use advanced security tooling and help ensure alignment with HIPAA, PCI, and other applicable laws, regulations, and standards. You are expected to stay current on solutions and technologies and advocate for enterprise security and architecture best practices.

Requirements

Bachelor’s degree or equivalent in a technical discipline, or a corresponding educational background with professional-level security certifications relevant to the role.
At least three years of mid-level cybersecurity experience at an analyst or engineer level.
Previous experience leading, supporting, managing, and administering at least one application.
Previous experience leading security projects and initiatives.
Previous healthcare experience in an IT or Security capacity.
Industry-recognized technical or professional security certification.
Ability to work independently with minimal oversight on a broad range of security projects and initiatives.
Demonstrated in-depth knowledge of information security principles, practices, solutions, and capabilities.
Demonstrated understanding of advanced security incident investigation techniques.
Intermediate understanding of threats and risks.
Intermediate-level knowledge of network, application, and systems security architecture.
Experience with desktop, server, network, database, and application security controls.
Leadership and project management skills.
Communication, customer service, and organization skills.
Participation in a 24/7 on-call support rotation.

Nice To Haves

Experience with common security testing methods and tool sets such as email security, vulnerability management, IDS/IPS, EDR, anti-malware, and proxy tools.
Previous experience with HIPAA, NIST, and project management.

Responsibilities

Administer, monitor, maintain, and continuously improve DLP technologies and workflows, including Microsoft Purview and endpoint DLP.
Triage and investigate DLP, Insider Risk, and other data-protection alerts across email, cloud, endpoint, and related environments; assess context, determine disposition, and coordinate follow-up with users and business units.
Conduct and support investigations and scans involving sensitive data and requirements such as HIPAA, PCI, and other regulatory or organizational obligations; collect and preserve relevant evidence and document findings.
Coordinate DLP incident response, containment, escalation, and remediation with Cyber Operations, the MSSP, business and clinical partners, and other stakeholders; track cases through resolution and capture lessons learned.
Develop, maintain, and refine DLP policies, detection rules, runbooks, playbooks, investigation procedures, escalation criteria, and ServiceNow or other case-management workflows.
Analyze alert outcomes and false positives and recommend improvements to DLP policies, detections, processes, and supporting tools.
Develop DLP metrics and reports covering alert volume and disposition, investigation aging and workload, response performance, policy effectiveness, and workflow automation.
Identify and implement appropriate automation for repeatable DLP tasks, including alert enrichment, evidence collection, case creation, notifications, and escalation; use SOAR or workflow tools where appropriate.
Support broader Cyber Operations activities as assigned, including complex security incident investigations and response, recovery coordination, cybersecurity projects, and collaboration with peers and operational teams.
Manage, administer, monitor, and support other assigned security applications; troubleshoot and resolve cybersecurity technology issues.
Participate in system and project security reviews, risk and impact assessments, control development, audits, and compliance activities, including support for HIPAA, PCI, and other applicable requirements.
Participate in an on-call rotation with peers to address assigned incidents and perform other duties as assigned.