Security Engineer III

🕒 il y a 25 jours

🌲 North Carolina – Distant

🌲 North Carolina – Remote

💵 $150 000 / an

⏰ Temps Plein

🟡 Intermédiaire

🟠 Senior

👮‍♂️ Cybersécurité / Ingénieur Sécurité

Postuler Maintenant

Trouver des Emplois à Distance Similaires

Recevoir des emails pour des emplois à distance

📊 Vérifiez votre score de CV pour ce poste

Améliorez vos chances d'obtenir un entretien en vérifiant votre score de CV avant de postuler.

Télécharger le CV

Aspirion

Site WebLinkedInTous les Emplois

1001 - 5000 employés

Fondée en 2006

⚕️ Assurance santé

🤖 Intelligence artificielle

☁️ SaaS

💰 Series unknown en 2012-02

Healthcare Insurance • Artificial Intelligence • SaaS

Aspirion est une entreprise de gestion du cycle des revenus dans le secteur de la santé qui aide les hôpitaux à récupérer les revenus des demandes refusées et complexes. L'entreprise utilise l'automatisation par IA et une plateforme propriétaire appelée Compass, dotée d'avocats, de cliniciens et d'ingénieurs en IA basés aux États-Unis, pour renverser les refus cliniques, maximiser les remboursements hors réseau, effectuer des révisions de solde nul et récupérer les écarts de paiement dans des services tels que la gestion des refus, la gestion des comptes clients, les demandes complexes, les accidents de la route, la compensation des travailleurs, TRICARE et Medicaid hors état. Aspirion met l'accent sur l'impact mesurable de la récupération (plus de 6 milliards de dollars capturés), l'augmentation des collections pour les clients, la certification HITRUST, les distinctions Best in KLAS, et les partenariats avec de grands systèmes de santé.

Description

• Own cloud security engineering for AWS by defining guardrails and configuration baselines (e.g., IAM least privilege, network segmentation, encryption, logging), partnering on implementation, and driving remediation of cloud posture findings to closure. • Engineer security controls and governance for Kubernetes and containerized workloads (e.g., EKS): define and enforce admission policies, Pod Security standards, network policies, image governance, runtime protections, and secrets management patterns; partner with platform teams on implementation within clusters and supporting IAM. • Drive secure SDLC controls and engineering governance: integrate and operate scanning and policy gates for application code (SAST), dependencies (SCA), secrets, containers/images, and Infrastructure as Code (IaC); define practical remediation SLAs and exception/waiver workflows aligned to risk. • Define security policies, standards, and best practices for cloud and containerized environments, and translate them into implementable guardrails and reference patterns (policy-as-code, reference configurations, and developer guidance), including encryption/key management (e.g., KMS), secrets storage, and secure workload access patterns; validate adoption and baseline compliance in partnership with Infrastructure/Platform teams. • Partner with Compliance to align technical controls to HIPAA requirements and produce audit-ready evidence (configurations, screenshots/exports, control narratives, and remediation tracking) for cloud and container platforms. • Improve security visibility and detection in AWS and Kubernetes: define requirements, ensure high-quality logging, and create actionable detections/alerts in partnership with the SOC/SIEM owners. • Run vulnerability management across the stack for cloud and containerized applications: triage and prioritize findings for application code, Infrastructure as Code, container images, third-party dependencies, and OS packages; coordinate fixes with engineering/platform teams, validate remediation, and track risk-based exceptions. • Support incident response for cloud and container security events: perform technical triage, containment support, root cause analysis, and deliver preventative engineering changes. • Develop and maintain security-as-code standards and reusable guardrails (e.g., Terraform modules/policies) and automated checks/policy gates to enforce baseline compliance across AWS accounts and Kubernetes clusters; partner with Infrastructure/Platform teams to roll out and operationalize these controls at scale. • Independently manage security engineering deliverables from intake through delivery: clarify requirements, design solutions, document decisions/runbooks, and communicate status/risks to stakeholders. • Translate HITRUST MyCSF/HIPAA and internal security policies into measurable cloud and SDLC control requirements; validate control effectiveness through testing and evidence collection. • Contribute to security tool administration and continuous improvement (e.g., cloud posture management, vulnerability scanning, CI/CD scanning tools) by tuning rules, reducing false positives, and improving developer usability. • Participate in on-call/escalation processes as needed; maintain runbooks and support post-incident reviews and corrective actions. • Serve as a technical resource for peers through code/config reviews, pairing, and clear documentation; help raise the security bar through pragmatic standards and guidance. • Perform other duties as assigned.

🎯 Exigences

• 5+ years in security engineering, cloud infrastructure, DevOps, or related technical roles, with significant hands-on responsibility securing production AWS environments. • Demonstrated experience implementing and improving cloud security posture (guardrails, standards, continuous compliance, vulnerability management) with measurable remediation outcomes. • Strong AWS IAM skills (roles/policies, least privilege design, identity federation, service roles) and experience implementing secure access patterns for humans and workloads. • Hands-on Kubernetes/container security experience, including implementing secure cluster/workload configuration and image governance in a production containerized environment. • Experience implementing and evidencing security controls in regulated environments (HIPAA required), including encryption/key management, logging retention, and change/audit trails. • Experience supporting incident response for cloud/workload security events, including investigation support, containment actions, and post-incident remediation. • Automation and IaC experience (e.g., Python/Bash; Terraform) and familiarity with implementing policy-as-code and continuous compliance checks. • Experience assessing and improving security for application code and IaC (e.g., Terraform/CloudFormation/Kubernetes manifests), including code review support, scanning, and remediation guidance. • Experience managing container security vulnerabilities end-to-end, including image scanning, base image/OS package patching strategies, rebuild processes, and validation of remediations in deployment pipelines. • Demonstrated experience implementing secure SDLC controls in CI/CD (e.g., GitHub Actions/Jenkins/GitLab), including SAST/SCA, container image scanning, secrets scanning, pipeline gates, and actionable remediation workflows. • Experience operating in regulated environments (HIPAA required); familiarity with NIST and/or HITRUST is strongly preferred. • Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or related field preferred (or equivalent practical experience). • Security and cloud certifications preferred: AWS Certified Security – Specialty or AWS Solutions Architect, Certified Kubernetes Security Specialist (CKS) or equivalent, and/or CISSP/CCSP (or ability to obtain within an agreed timeframe).