IT Security Engineer

About the company

• Position listed on behalf of a partner company managing applications and next steps.
• Large-scale healthcare technology environment.

Responsibilities

• Plan and execute penetration tests across internal/external infrastructure, networks, web and mobile applications.
• Perform application security assessments (manual and tool-assisted) throughout SDLC, including gray-box testing.
• Assess cloud security across AWS, Azure, and/or GCP (configurations, IAM, workloads, exposure).
• Simulate adversary techniques against production and pre-production systems.
• Develop and maintain security tools and automation, custom scripts.
• Document findings with risk ratings, reproduction steps, business impact, remediation recommendations.
• Support vulnerability remediation with engineering, infrastructure, and product teams.
• Support compliance and audits (HIPAA, SOC 2, PCI DSS).
• Monitor emerging threats and threat intelligence.
• Participate in tabletop exercises, purple-team activities, security awareness.
• Improve offensive security methodologies and tooling.

Requirements

• 5+ years hands-on penetration testing / offensive security (infrastructure, network, application).
• At least one offensive security certification: OSCP, GPEN, GWAPT, GXPN, or CEH.
• Cloud security experience in multiple environments (AWS, Azure, GCP).
• Knowledge of MITRE ATT&CK, OWASP Testing Guide, PTES.
• Proficiency with Burp Suite, OWASP ZAP, Nmap, Metasploit, BloodHound, Nuclei.
• Scripting: Python, PowerShell, Bash.
• Experience with HIPAA, SOC 2, PCI DSS environments.
• Strong technical communication skills.
• Independent execution in fast-paced cross-functional organization.
• Plus: OSWE, OSCE/OSEE, GXPN, CISSP, CCSP; Kubernetes/container security; REST/GraphQL API security; CI/CD pipeline security.

Conditions

• Remote opportunity.