Consultant, Security Architecture (Hybrid in Nashville, TN)

At ScionHealth, we empower our caregivers to do what they do best. We value every voice by caring deeply for every patient and each other. We show courage by running toward the challenge and we lean into new ideas by embracing curiosity and question asking. Together, we create our culture by living our values in our day-to-day interactions with our patients and teammates.

Job Summary

Serves as the enterprise technical authority for the security architecture, governance, and continuous improvement of ScionHealth's Microsoft 365 and related Microsoft cloud security environment. Designs and maintains security architecture across Microsoft Entra ID, Microsoft Intune, Microsoft Defender, Microsoft Purview, Microsoft Sentinel, and Azure security services. Partners with Cybersecurity Operations, Infrastructure Services, Identity and Access Management, Enterprise Architecture, Clinical Informatics, Compliance, Legal, and Internal Audit to reduce cyber risk, protect sensitive information, and enable secure clinical and business operations.

Essential Functions

• Develops and maintains the enterprise Microsoft 365 security architecture, roadmap, standards, reference designs, and technical governance.
• Leads implementation of Zero Trust principles and evaluates emerging Microsoft security capabilities for enterprise adoption.
• Conducts architecture reviews and security assessments and develops risk-based remediation recommendations.
• Ensures Microsoft cloud security architecture aligns with enterprise cybersecurity strategy, policies, risk tolerance, and regulatory obligations.
• Architects security controls for Microsoft Entra ID, conditional access, multifactor and passwordless authentication, privileged identity management, identity governance, lifecycle workflows, federation, and single sign-on.
• Designs secure access patterns for employees, clinicians, contractors, vendors, remote users, third-party applications, and external collaboration.
• Architects endpoint security using Microsoft Intune, Microsoft Defender for Endpoint, Endpoint Privilege Management, device compliance, Windows security baselines, BitLocker, Autopilot, mobile device management, mobile application management, and bring-your-own-device controls.
• Partners with operational teams to secure clinical workstations, shared devices, executive devices, mobile devices, and virtual desktop environments.
• Leads architecture and deployment of Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and related exposure management capabilities.
• Designs security monitoring and analytics using Microsoft Sentinel, Azure Monitor, security dashboards, SIEM integrations, and SOAR automation.
• Partners with the Security Operations Center to improve visibility, threat detection, automated investigation, threat hunting, incident response, and reduction of false positives.
• Defines security telemetry, alerting, integration, and escalation requirements for Microsoft cloud services.
• Architects Microsoft Purview capabilities, including data loss prevention, information protection, sensitivity labels, data classification, insider risk management, records management, eDiscovery, communication compliance, and information barriers.
• Evaluates Microsoft Secure Score, identity and endpoint posture, vulnerabilities, configuration risk, and control effectiveness; leads development of remediation priorities.
• Ensures security architecture supports HIPAA, HITECH, applicable CMS and Joint Commission requirements, state privacy requirements, PCI-DSS where applicable, and internal governance standards.
• Creates and maintains security architecture diagrams, standards, control requirements, operating procedures, and technical documentation.
• Provides architectural leadership for major Microsoft security implementations, cloud adoption, acquisitions, integrations, and modernization initiatives.
• Advises technical and business leaders on security risks, control options, tradeoffs, and implementation priorities.
• Mentors security engineers and analysts and provides escalation support for complex Microsoft cloud security issues.
• Collaborates with Microsoft, implementation partners, and strategic vendors to validate designs, resolve issues, and improve security maturity.

Knowledge/Skills/Abilities/Expectations