Senior Corporate Security Engineer

Charlie Health•Nashville, TN

2d•$180,000 - $240,000•Hybrid

About The Position

The Senior Corporate Security Engineer designs, builds and operates technical security systems and controls that protect Charlie Health’s corporate environment, workforce systems, endpoints, SaaS platforms, cloud-connected services and internal operations. This senior hands-on role focuses on enterprise security, identity and access management, endpoint and SaaS security, data protection, security automation, cloud security and detection engineering. The engineer partners with IT Engineering, Information Security, Compliance, Engineering and business teams to reduce risk, improve control maturity and support organizational growth. Charlie Health treats security as an engineering discipline, emphasizing ownership, measurable outcomes, automation, reliability, secure-by-design implementation and continuous improvement. The role builds scalable security capabilities that protect sensitive company, employee, clinician and patient data while enabling the business to operate safely and efficiently. It also helps secure the organization’s adoption of AI tools, LLM platforms, AI-enabled workflows and emerging AI security products, and supports controls aligned with HIPAA, SOC 2, NIST, Zero Trust principles and other applicable regulatory and contractual requirements. The position is hybrid, requiring four days per week in the Nashville office. Applicants must live within a 75-minute commuting distance. The target base compensation is $180,000–$240,000 per year at commencement of employment; actual compensation is determined individually based on factors including location, experience, leveling, expertise and internal pay equity. The compensation package may also include stock options and other company-sponsored benefits.

Requirements

At least 5 years of experience in security engineering, corporate security, infrastructure security, enterprise security, IT security, cloud security or a related technical discipline.
Deep hands-on experience designing, building and operating technical security controls in enterprise environments.
Experience securing identity, endpoints, SaaS platforms, collaboration tools, cloud-connected services and internal systems.
Strong experience with identity and access management concepts, including MFA, conditional access, privileged access, lifecycle automation, service accounts and least privilege.
Experience with security tools such as MDR platforms, EDR, SIEM, cloud security, endpoint management, vulnerability management or DLP systems.
Experience with platforms and telemetry sources such as Expel MDR, SentinelOne, Wiz, CloudTrail, Sumo Logic or similar tools.
Experience with endpoint security, MDM, secure configuration management and vulnerability remediation across Mac, Windows or mobile environments.
Experience using scripting, APIs or automation tools such as Python, Bash, PowerShell, Workato, Terraform, REST APIs, webhooks or JSON.
Familiarity with detection engineering, alert tuning, incident response workflows and security operations processes.
Strong understanding of Zero Trust principles, identity-centric security, least privilege, device trust and secure system design.
Ability to work cross-functionally with IT, Security, Engineering, Compliance and business stakeholders.
Strong documentation, ownership and judgment, with the ability to work independently in ambiguous environments.
Ability to work a hybrid schedule of four days per week in the Nashville office and live within a 75-minute commuting distance.

Nice To Haves

Experience operating at a Staff Engineer or senior technical leadership level.
Experience in healthcare, financial services or another regulated environment.
Experience supporting HIPAA, SOC 2, NIST, ISO 27001 or similar security and compliance frameworks.
Experience securing enterprise AI tools, LLM platforms, AI agents or AI-enabled workflows.
Exposure to AI platforms and security tools such as OpenAI, Anthropic, LiteLLM, Prompt Security, Pillar or similar technologies.
Experience with DLP, CASB, SSPM, browser security, SaaS posture management or data discovery tools.
Experience securing Google Workspace, Okta, Jamf, Microsoft Intune, GitHub, Slack, Atlassian, AWS or similar enterprise platforms.
Experience building automations using REST APIs, webhooks, JSON, service accounts and API authentication patterns.
Experience partnering with managed security providers, MDR teams, external auditors or compliance teams.
Familiarity with AI security risks including sensitive data exposure, prompt injection, model access control, third-party plugin risk and AI system logging.

Responsibilities

Design, build and operate technical security controls across the corporate technology environment.
Engineer scalable security solutions for identity, endpoints, SaaS platforms, cloud-connected services, collaboration tools and internal systems.
Translate security requirements into technical controls, automations, detections and operational workflows; partner with IT Engineering to embed secure-by-design practices.
Establish control patterns that improve security posture, operational efficiency, auditability and resilience.
Design and improve identity and access controls, including MFA, conditional access, device trust, role-based access, least privilege, service accounts and lifecycle automation.
Partner with IT and business teams to improve joiner, mover, leaver, access review and elevated-access processes, and advance Zero Trust controls.
Improve security across Mac, Windows, mobile and BYOD environments, including configuration baselines, MDM policy, EDR coverage, device compliance and vulnerability remediation.
Assess and improve the security posture of corporate SaaS platforms, integrations, APIs and service accounts; configure and operationalize security tooling across relevant platforms.
Support cloud security visibility and control implementation across AWS and related services, including CloudTrail and other telemetry sources.
Build and improve detections, alerts, dashboards, runbooks and response workflows; partner with Expel MDR and internal teams to improve telemetry, alert fidelity, investigations and response outcomes.
Support investigation and response for identity, endpoint, SaaS, email, cloud, data exposure and corporate security events; tune tools and develop repeatable playbooks and procedures.
Secure the use of AI tools, LLM platforms, AI agents and AI-enabled workflows; evaluate controls for data protection, prompt-layer security, access governance, logging and usage monitoring.
Partner with relevant teams to define practical security patterns for AI platforms and assess risks such as sensitive data exposure, PHI leakage, model access, third-party integrations and AI-enabled automation.
Design and operate controls protecting PHI, employee and clinician data, and sensitive company information; support DLP across SaaS, endpoints, browsers, collaboration tools, email, cloud and AI systems.
Improve visibility into sensitive data movement, sharing and policy violations, and build automations and reporting for DLP response, control monitoring and evidence collection.
Build automations for security operations, access management, control monitoring, remediation and audit evidence collection using APIs, scripting, webhooks, workflow platforms and infrastructure-as-code practices.
Develop maintainable security workflows and apply version control, code review, documentation, testing and repeatable deployment practices.
Implement and maintain controls supporting HIPAA, SOC 2, NIST, ISO 27001 and other applicable frameworks; support evidence collection, control testing, remediation planning and continuous monitoring.
Identify and document security risks, partner with stakeholders on remediation, translate compliance requirements into engineering solutions, and help define metrics for control health, security posture, operational maturity and risk reduction.