Security Engineer

About The Company

American Oncology Network (AON) is a leading healthcare provider dedicated to delivering exceptional oncology services across a distributed network of clinical locations. Committed to advancing patient care through innovative technology and comprehensive clinical expertise, AON prioritizes the security and privacy of patient information as a fundamental aspect of its operations. Our enterprise security program is designed to protect sensitive healthcare data and ensure compliance with industry regulations, fostering a safe and secure environment for both patients and staff. As a dynamic organization, AON values collaboration, continuous improvement, and the professional growth of its employees.

About The Role

The Lead Security Engineer at American Oncology Network plays a critical role in the oversight and enhancement of the enterprise security infrastructure. This remote position reports directly to the Director of IT Security and involves hands-on leadership of a team of three security professionals. The role encompasses ownership and administration of security tools and technologies, including SIEM/SOAR platforms, endpoint protection, email security, and privileged access management. The Lead Security Engineer will spearhead threat detection, incident response, vulnerability management, and compliance efforts aligned with HIPAA and NIST frameworks. Additionally, this position is responsible for managing relationships with managed security service providers and ensuring consistent security practices across all AON locations. The ideal candidate will combine technical expertise with strong leadership skills to safeguard clinical operations and patient information in a complex healthcare environment.

Qualifications

• Bachelor’s degree in Information Security, Computer Science, or a related field preferred.
• Minimum of 8 years of experience in information security or security engineering with hands-on operation of production security tools.
• At least 2 years of experience leading or mentoring security staff.
• Proven experience overseeing MSP, MSSP, or MDR providers, leading security investigations, and administering SIEM/XDR and vulnerability management technologies.
• Knowledge of HIPAA, HITECH, and healthcare security frameworks such as HITRUST and NIST CSF.
• Practical experience with endpoint, email, network, cloud, and privileged access security, including Microsoft 365, Azure, Entra ID, Rapid7 InsightIDR, and InsightVM.
• Preferred experience in healthcare or multisite provider environments, familiarity with EHR systems (e.g., OncoEMR), and involvement in M&A or new-site security integrations.
• Preferred certifications: CISSP, GIAC (GCIH, GCIA, GSEC), CCSP, or Microsoft security certifications.
• Strong skills in security engineering, incident response, vulnerability management, identity and access management, cloud security, vendor oversight, security compliance, team leadership, scripting and automation (PowerShell/Python), and technical risk communication.
• Willingness to travel up to 25% as needed.
  
  

Responsibilities

• Administer and optimize the enterprise security technology stack, including SIEM/SOAR, endpoint protection, email security, privileged access management, and secure network access.
• Maintain and configure security tools such as Rapid7 InsightIDR, InsightVM, InsightConnect, Bitdefender GravityZone, Mimecast, Delinea Secret Server, and Cato security solutions.
• Secure Microsoft 365, Azure, and other cloud/SaaS environments by establishing baselines and monitoring security postures.
• Manage licensing, coverage, and renewals of security tools to ensure cost-effective protection.
• Lead security event triage, incident investigations, containment, recovery, and post-incident analysis in collaboration with managed detection and response providers.
• Oversee vulnerability scanning, prioritization, remediation, and patch management across all endpoints, servers, cloud platforms, and network infrastructure.
• Document risks related to legacy systems and validate compensating controls when remediation is not immediately feasible.
• Develop response runbooks, technical standards, and repeatable procedures to support consistent security operations.
• Enhance identity and access security through multifactor authentication, conditional access, privileged access management, and periodic access reviews.
• Coordinate annual HIPAA- and NIST-aligned security risk assessments, vulnerability assessments, and penetration tests with external partners.
• Track and drive remediation of assessment findings and security gaps, communicating risks and priorities to stakeholders.
• Assess security risks associated with third-party vendors, integrations, new sites, and acquisitions.
• Serve as the technical lead for managed service and security partners, validating deliverables, service quality, and adherence to SLAs.
• Escalate and coordinate corrective actions with internal and external stakeholders.
• Lead, mentor, and develop security team members, establishing priorities and reviewing work quality.
• Identify and implement security workflow improvements through scripting and automation using PowerShell and Python.
• Effectively communicate security risks, operational priorities, and remediation progress to both technical and non-technical audiences.
  
  

Benefits

• Competitive salary range from $104,200 to $155,800 annually.
• Remote work opportunity supporting work-life balance.
• Flexible working hours to accommodate individual needs.
• Ergonomic home office guidance and support.
• Access to communication software and tools to facilitate remote collaboration.
• Opportunities for professional development and certification support.
• Comprehensive health and wellness programs.
• Inclusive and supportive company culture focused on employee growth.
  
  

Equal Opportunity

American Oncology Network is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All employment decisions at AON are based on business needs, job requirements, and individual qualifications, without regard to race, color, religion, gender, sexual orientation, gender identity or expression, age, national origin, disability status, genetics, protected veteran status, or any other characteristic protected by applicable law. We are dedicated to compliance with the Americans with Disabilities Act (ADA) and provide reasonable accommodations to qualified individuals with disabilities in accordance with applicable laws.