Senior Security Administrator

Position Summary

The Security Administrator is a key member of FFF Enterprises’ Information Security team, responsible for strengthening and maintaining the company’s overall security posture. This role oversees the evaluation, testing, and documentation of security controls while designing and implementing strategies to protect the organization’s digital and physical assets against unauthorized access, data breaches, disruption, or other threats.

Partnering closely with Information Security leadership, IT teams, and business stakeholders, the Security Administrator ensures security principles are embedded across all technology systems and processes. This position provides expert guidance on risk mitigation and regulatory compliance, supporting FFF’s mission to protect sensitive data, enable operational resilience, and maintain trust with patients, partners, and the healthcare community.

Essential Functions and Duties

Information Security & Access Management:

• Develop, implement, and enforce policies to govern access to company resources, including the Office 365 environment, for both human and machine identities.
• Ensure the security, integrity, and compliance of Active Directory, Entra ID, Okta, and other cloud-based identity providers (IDPs).
• Configure and manage Microsoft Purview tools such as Data Loss Prevention (DLP), sensitivity labels, and retention policies to protect sensitive data and ensure regulatory compliance.
• Oversee and integrate advanced identity technologies, including Privileged Access Management (PAM), Identity Governance & Administration (IGA), User and Entity Behavior Analytics (UEBA), Cloud Infrastructure Entitlement Management (CIEM), Customer Identity and Access Management (CIAM), and Network Host Integration (NHI).
• Manage centralized user security and entitlement reviews, including recurring certifications and related audit processes, to ensure access is appropriate and compliant.
• Assess and mitigate organizational risks associated with user access, data access, and identity governance, providing recommendations for improved security posture.
• Establish, document, and maintain standards, policies, and procedures related to identity management and infrastructure.
• Provide guidance, education, and training to IT staff and business users on identity and access management (IAM) policies, tools, and best practices to promote consistent and secure practices across the organization.

Security Control Assessment:

• Conduct comprehensive security audits and risk assessments of systems, infrastructure, and identity environments to identify vulnerabilities and compliance gaps.
• Develop and deliver detailed reports that clearly outline audit findings, highlighting areas of strength, potential risks, and opportunities for process improvement.
• Provide strategic, consultative guidance to cybersecurity governance and infrastructure teams to enable informed decision-making and effective prioritization of resources.
• Facilitate the implementation of appropriate control measures aligned with the organization’s risk appetite to proactively monitor, mitigate, and manage cybersecurity threats.
• Ensure identified risks are remediated in a timely manner and that all residual risks are accurately documented, tracked, and reported to leadership for ongoing oversight.

Security Event & Incident Response:

• Continuously monitor system logs, SIEM tools, network traffic, user activity, and endpoint behavior to identify unusual or suspicious activity that may indicate potential threats.
• Collaborate with internal teams and external partners to manage, contain,