Sr. Security Engineer (Security Engineering & Operations)

At the Oral Health Innovation Center (OHIC), a subsidiary of Delta Dental, we are transforming the future of dental care through cutting-edge digital experiences and dental-medical integrations.

We are an enterprise start-up, and the OHIC Information Security team is focused on building a comprehensive information security program and solutions from the ground up to support future growth.  Due to the small team size, success in this role requires broad and deep experience, along with strong communication skills. 

The candidate must be available during core business hours in the Pacific Time Zone and be available for occasional evenings or weekends for go-live activities or security incident response.

This role supports foundational security engineering and operations in a dynamic, fast-growing environment.  We're looking for someone with strong enterprise experience in security engineering, as well as security monitoring and incident response who, is also comfortable contributing to broader security efforts, including vulnerability management, documentation, and operational process development.  As we continue to scale, this person will play a key role in helping us operationalize and mature critical security practices across the organization.

• Contribute to the end-to-end execution of security controls, including planning, designing, configuring, documenting, and auditing, and own two or more controls as assigned, with a focus on supporting audit readiness for frameworks (e.g., HIPAA, SOC 2, NIST CSF) in a highly regulated environment
• Partner with control owners outside of the Information Security team to validate secure configurations and ensure alignment with security objectives
• Develop and maintain foundational playbooks and documentation as security controls are iteratively implemented and matured
• Engineer, deploy, and operate security tools to enable visibility, control, and operational effectiveness
• Monitor and triage security alerts, support incident analysis and response, and document response protocols
• Conduct threat assessments and recommend enhancements to security configurations
• Support risk management processes by identifying, assessing, and helping mitigate security risks
• Ensure compliance with applicable laws, regulations, and standards relevant to the U.S. healthcare industry

• 7+ years of professional, hands-on experience in security engineering and operations, along with a Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or a related field; an equivalent combination of education and experience may be considered 
• 3+ years of hands-on experience in Microsoft environments
• This role will require the management of several (2 to 4) concurrent information security capabilities
• While not currently applicable, future scale and growth may require engaging a Managed Security Service Provider (MSSP).  This role would lead the engagement and maintain SME experience, acting as a liaison on behalf of OHIC Security with the MSSP and the Electronic Health Record (EHR) Security Operations Center (SOC)

Knowledge, Skills, and Abilities: 

• Experience with Microsoft technologies, including Entra ID (formerly Azure Active Directory), on-premises Active Directory, and Azure cloud services
• Microsoft M365 Defender security services experience
• Willingness to support hands-on access provisioning as part of operational IAM responsibilities
• Practical security engineering and operations experience with SIEM (Security Information and Event Management), Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), and log analysis tooling and processes
• Experience or willingness to learn about adjacent security operations functions, including, but not limited to, vulnerability management 
• Knowledge of laws, regulations, and standards relevant to the U.S. healthcare industry, such as Health Insurance Portability and Accountability Act (HIPAA), System and Organization Controls 2 (SOC 2), and National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)
• Ability to clearly communicate complex topics to technical or non-technical audiences
• Exceptional technical writing skills, including process documentation, procedural design, and visual representation of workflows
• Comfortable operating in ambiguity and taking the initiative to move work forward without perfect clarity, while collaborating effectively across team