Surescripts serves the nation through simpler, trusted health intelligence sharing, in order to increase patient safety, lower costs and ensure quality care. We deliver insights at critical points of care for better decisions — from streamlining prior authorizations to delivering comprehensive medication histories to facilitating messages between providers.
 

Job Summary

The Senior Cloud Security Engineer helps architect, deploy, and operate the security cloud infrastructure that aligns with business needs. The position is responsible for supporting operational innovation and providing security direction to the business to elevate the company’s security posture within its cloud computing infrastructure. Along with security leadership, the Senior Cloud Security Engineer will consistently assess the threat landscape and adapt quickly to protect the business from risk.

Responsibilities

• Develop and maintain secure, resilient enterprise-grade cloud processes in tandem with architects and system engineers.

• Secure business applications and computing environments across commercial, private or hybrid cloud infrastructures.

• Protect business applications in compliance with privacy, security, business resiliency and compliance frameworks as defined in corporate policies.

• Maintain a consistent, secure cloud security environment. Conduct rigorous oversight of security systems and security configuration administration to reduce risk to enterprise systems and accounts.

• Deploy strong identity and access management (IAM) controls across applications and computing environments.

• Assist with development, maintenance, and utilization of scripts (e.g., Python, PowerShell, JavaScript) to support custom extract, transform load (ETL) tools with a security focus for data flow.

• Attend regular technical project and implementation meetings and serve as the security consultant to help guide secure cloud application and infrastructure configurations.

• Actively monitor, assess, and recommend tactical and strategic initiatives based on new and emerging threats posing risk to cloud computing environments.

• Manage remediation efforts after security assessment findings identify weaknesses requiring attention.

• Document, formulate and enforce areas of security improvement that balance risk with business operations and do not diminish efficiencies or innovation.

• Assist in maintaining strong oversight with cloud computing vendors and solution providers to safeguard against undue risk presented by external entities. Escalate to security management and business unit leads when points of weakness are discovered.

• Stay apprised of current and proposed security changes impacting regulatory, privacy and security industry best practice guidance. Apply learned knowledge across key lines of business, including products, practices, and procedures.

• Serve as a key resource in incident response to track occurrence and resolution, with strict documentation and reporting as well as engagement with security operations and incident response teams.

• Attend and fully engage in change and project management meetings.

• Produce security metrics for security and business leaders.

• Provide and participate in cross training to ensure business continuity.

• Perform other duties as assigned.

Qualifications

Basic Requirements:

• Bachelor's degree in computer science, information systems, MIS or related field, or equivalent experience.

• 5+ years of experience in progressive, related experience in cybersecurity as a practitioner.

• 2+ years of experience with public cloud providers (AWS, GCP).

• Strong Linux and Windows support skills.

• Experienced in cloud networking architecture and cloud operations.

• Strong experience with SIEM and/or SOAR tools. Splunk preferred.

• Familiarity with security solutions such as CrowdStrike, Tenable, Proofpoint.

• Familiarity with tools such as Terraform, Git, Jenkins, Chef, Puppet and Salt.

• Experience with scripting languages such as Python, Ruby, PowerShell and JavaScript.

• Network and encryption experience, including virtual private networks (VPNs), IPsec, SSL/TLS, LDAP and public key infrastructure (PKI).

• Experience and understanding of various regulatory requirements and laws, including but not limited to: HITRUST, HIPAA, NIST, SOC2.

• Up-to-date understanding of a wide range of incident response, system configuration, vulnerability management and hardening guidelines.

• Cyber security experience and proficiency in: