IT Security Lead Engineer

Location:

Remote Position

Hiring Range:
$The Lead Security Engineer provides hands-on technical leadership for American Oncology Network’s enterprise security program, overseeing security tools, configurations, monitoring, vulnerability management, incident response, and managed security service partners across a distributed healthcare environment. Reporting to the Director of IT Security, this role leads and develops a team of three security staff, strengthens the protection of patient information and clinical operations, and drives consistent security practices across AON locations.
Key Performance Areas

Own and administer the security technology stack, including SIEM/SOAR, endpoint protection, email security, privileged access management, and secure network access.
• Maintain and optimize Rapid7 InsightIDR, InsightVM and InsightConnect, Bitdefender GravityZone, Mimecast, Delinea Secret Server, and Cato security configurations and coverage.
• Secure Microsoft 365, Azure and other cloud/SaaS environments by establishing configuration baselines and monitoring security posture.
• Lead security event triage and incident investigations in partnership with the managed detection and response provider; Oversee vulnerability scanning, prioritization, remediation, and patch management across endpoints, servers, cloud platforms, and network infrastructure.
• Document risks associated with legacy systems and validate compensating controls where timely remediation is not feasible.
• Develop response runbooks, technical standards, and repeatable procedures to support consistent security operations.
KPA 3: Identity, Access and Security Risk Compliance
• Coordinate annual HIPAA- and NIST-aligned security risk assessments, vulnerability assessments, and penetration tests with external assessment partners.
• Track and drive remediation of assessment findings and security gaps, communicating technical risks and priorities to stakeholders.
• Assess security risks arising from third-party vendors, integrations, newly onboarded sites, and acquired practices.
Serve as the technical lead and primary day-to-day accountability point for managed service and security partners, including ATG and Rapid7 MDR.
• Validate provider deliverables, service quality, investigation work, and adherence to contractual service-level agreements.
• Escalate gaps and coordinate corrective action with internal IT stakeholders and external partners.
• Promote clear documentation, ownership, and communication across security operations and partner workflows.
Lead, mentor, and develop security staff by establishing priorities, reviewing deliverable quality, and building technical capabilities.
• Identify opportunities to improve security workflows through PowerShell, Python, and other scripting or automation methods.
• Communicate security risks, operational priorities, and remediation progress clearly to nontechnical leaders and clinical stakeholders.
Bachelor’s degree in information security, Computer Science or related field preferred.
8+ years of information security or security engineering experience, including hands-on operation of production security tools.
· Practical experience with endpoint, email, network, cloud, and privileged access security, including Microsoft 365, Azure, Entra ID, Rapid7 InsightIDR and InsightVM.
· OncoEMR), and M&A or new-site security integration.
CISSP, GIAC (GCIH, GCIA, GSEC), CCSP, or Microsoft security certifications.
Cloud Security
· Scripting and Automation (PowerShell/Python)
· Technical Risk Communication
Travel: 0-25%
The responsibilities listed may be subject to change at any time and individuals may be asked to perform duties outside of their regular responsibilities to support the ongoing business operation needs.
Americans with Disabilities Act (ADA) Compliance
The essential functions described herein are intended to define the fundamental duties of the position and serve as the minimum requirements for performance. AON complies with the Americans with Disabilities Act (ADA) and applicable state and local laws. The Company will engage in an interactive process to evaluate and, where appropriate, provide reasonable accommodations to qualified individuals with disabilities, provided such accommodations do not impose an undue hardship on the business.
Policy interpretation
Environmental Requirements
· Home office setup
· Minimal external environmental exposure
Flexible hours
· Ergonomic home office guidance
· Communication software accessibility