Health Gorilla

Security Engineer

• Help secure platforms that power nationwide health data exchange, protect patient privacy, and ensure compliance in a cloud-native, high-scale environment.
• Implement information security strategies and procedures, executing solutions that align with architectural designs, industry best practices, and regulatory requirements such as HIPAA and TEFCA.
• Proactively recommend modifications and enhancements to strengthen security posture and identify opportunities for continuous improvement.
• Work with engineering teams to define/refine information security systems management policies and settings.
• Conduct vendor and 3rd party information security audits and help with security questionnaires.
• Perform security analysis and risk assessments to identify threats and vulnerabilities, and document and remediate issues to safeguard information assets.
• Create AWS Cloud Formation templates, Ansible scripts and automation with AWS Systems Manager.
• Design, monitor, and enforce security controls using AWS-native security services including GuardDuty, Security Hub, Macie, Inspector, IAM, KMS, CloudTrail, and Config.
• Implement identity and access management best practices in AWS (least privilege, service control policies, cross-account roles, and MFA enforcement).
• Architect and operationalize security guardrails via AWS Config rules, SCPs, and automation (e.g., Lambda functions, EventBridge) for continuous compliance.
• Monitor and incident detection using GuardDuty findings, CloudWatch alerts, and CloudTrail logs, integrating with SIEM/SOAR platforms.
• Deploy, tune, and manage CrowdStrike Falcon EDR for endpoint visibility, prevention, and real-time response across cloud and enterprise environments.
• Perform threat hunting and investigation using CrowdStrike telemetry, Falcon OverWatch, and custom queries.
• Conduct malware analysis and incident response leveraging CrowdStrike’s real-time response capabilities, forensic data, and threat intelligence.
• Partner with other Cybersecurity, Engineering, and Product teams to align detection strategies with organizational objectives.
• Serve as central point of contact for 3rd party audits (SOC2, ISO, HIPAA, HITRUST), and other GRC functions

Senior Security Engineer