US-IT Security Eng Sr

R1 RCM•Remote, CA, CA

11d•$50,640 - $137,481

About The Position

R1 is hiring a Senior IT Security Engineer for its Offensive Security team to strengthen vulnerability discovery and remediation. The role conducts hands-on penetration testing across infrastructure, networks, and applications; tests across multiple cloud environments; and helps mature testing methodology and tooling for a healthcare technology company. This is an individual-contributor position with an opportunity to shape processes as well as execute tests. The engineer partners with engineering, infrastructure, and product teams to validate fixes, reduce remediation time, and support compliance assessments. The role also tracks relevant attack techniques and threat intelligence and contributes to tabletop exercises, purple-team collaboration, and internal security training as needed. The position is US-based. The listed annual base pay range is $50,640.00–$137,481.25, and the role is eligible for an annual bonus plan with a 10% target.

Requirements

At least 5 years of hands-on penetration testing or offensive security experience spanning infrastructure/network and application security testing.
At least one recognized offensive security certification, such as OSCP, GPEN, GWAPT, GXPN, or CEH, or equivalent demonstrated hands-on skill, with a track record of pursuing further certification.
Practical experience testing in multiple cloud environments among AWS, Azure, and/or GCP.
Working knowledge of MITRE ATT&CK, the OWASP Testing Guide, and PTES.
Fluency with open-source and commercial security tooling, such as Burp Suite, ZAP, Nmap, Metasploit, BloodHound, and Nuclei, and the judgment to select appropriate tools.
Scripting or automation ability in Python, PowerShell, or Bash to build custom tooling and speed up repeatable testing.
Experience working in environments subject to HIPAA, SOC 2, and/or PCI DSS.
Strong written and verbal communication skills, including the ability to explain findings and their real-world impact to technical and non-technical stakeholders.
Ability to operate independently in a large, fast-paced, matrixed organization.

Nice To Haves

Advanced certifications such as OSWE, OSCE/OSEE, GXPN, CISSP, or CCSP.
Experience testing containerized environments and Kubernetes.
API security testing experience with REST or GraphQL beyond standard web application testing.
Familiarity with CI/CD pipeline security and secure SDLC integration.
Experience contributing to or maintaining open-source security tools.
Healthcare, healthcare IT, or financial services industry experience.
Experience with AI models, harnesses, and exploiting AI services.

Responsibilities

Plan and execute penetration tests across internal and external infrastructure, networks, and web and mobile applications.
Perform manual and tool-assisted application security testing integrated into the SDLC, including source-code-assisted gray-box testing where applicable.
Test cloud environments such as AWS, Azure, and/or GCP, including cloud configuration, IAM, and workload-level exposures.
Simulate real-world adversary techniques against production and pre-production systems in coordination with engineering and infrastructure owners.
Build, maintain, and extend a toolkit of open-source and commercial tools; write custom scripts and tools to address gaps in coverage.
Document findings with risk ratings, reproduction steps, and remediation guidance for engineering teams and executive stakeholders.
Partner with engineering, infrastructure, and product teams to validate fixes and reduce time-to-remediation.
Support testing related to HIPAA, SOC 2, and PCI DSS compliance obligations, assessments, and audits.
Track emerging attack techniques, exploits, and threat intelligence relevant to healthcare and revenue cycle technology environments.
Contribute to tabletop exercises, purple-team collaboration, and internal security training as needed.