Senior Security Engineer - Incident Response

Position Overview

As our Senior Security Engineer - Incident Response, you will be working alongside an existing team of experienced security engineers and partnering closely with technologists across the company to help build digital health security and protect our patients here at Thirty Madison! We serve our patients from start to finish, and security works the same way, all the way from the deepest infrastructure to the patient experience, we want our patients to be safer by being with Thirty Madison. Above all, you embody the Thirty Madison mission of providing access to healthcare for all who suffer from chronic conditions.

Compensation & Benefits

• Salary: $174,400 - $239,800 per year
• Annual Incentive Plan + Stock Option Package
• Robust and affordable Medical, Dental, and Vision plan options
• 401(k) with a match, commuter benefits, and FSA
• Annual $750 vacation stipend and $500 happiness stipend
• Flexible time off policy

Note: Base pay offered may vary depending on job-related knowledge, skills, and experience. An annual incentive plan and stock options may be provided as part of the compensation package, in addition to a full range of medical, financial, and/or other benefits, dependent on the position offered.

Responsibilities

• Build and mature a detection engineering program.
• Detect and respond to security incidents and participate in an incident on-call rotation.
• Develop innovative ways to detect security incidents.
• Design and build the security for the future of our infrastructure.
• Partner with the infrastructure team, engineering team, compliance team, and within security teams to maintain and further improve our cloud security posture.
• Create solutions and processes to identify, resolve, and mitigate security vulnerabilities and risks.
• Research threats and attack vectors that impact Thirty Madison’s applications and infrastructure.
• Devise and bolster defense-in-depth through secure-by-default frameworks, architectures, and processes.
• Mentor and share security standards and processes with all parts of the organization.
• Other duties as assigned.

Requirements

• Expertise responding to complex incidents across endpoint, network, and cloud.
• Capable of understanding an unfamiliar system enough to successfully respond to an incident involving the system.
• Expertise in detection engineering.
• Experience with SIEM, EDR, and CSPM tools.
• Deep understanding of the threat landscape.
• Experience with assessing risks.
• Experience in cloud security, especially for AWS, including IAM, secure configuration of services, and AWS native security services like AWS Cloudtrail, SCP’s, AWS Org, Config, etc.
• Ability to understand the whole solution, not just the technology.
• Focus on the end-to-end lifecycle of solving a problem and solutioning for it, not just implementing a security technology. Have a well-rounded view for problem-solving.
• Deep care for the patient and your fellow employees' experience as you surpass security challenges.
• Hunger to drive decision-making, collaboration, and to have deeper opinions on security design.
• Ability to review different design choices and understand/discuss pros and cons for each.
• Ability to code to automate tedious tasks.
• Experience with Infrastructure as Code (Terraform experience is a plus).
• Strong collaboration skills with the wider security team and engineering at Thirty Madison.

Note: Don’t meet every single requirement? Studies have shown that women and people of color are less likely to apply to jobs unless they meet every single qualification. At Thirty Madison, we are dedicated to building a diverse, inclusive, and authentic workplace, so if you’re excited about this role but your past experience doesn’t align perfectly with every qualification, we encourage you to apply!

Company Information

Thirty Madison is dedicated to providing access to healthcare for all who suffer from chronic conditions.

Location Type

• (Information not provided in the original text)

Employment Type

• (Information not provided in the original text)

Application Instructions

• U.S. Applicants Only.

All Company policies and procedures are subject to change without notice based on business needs. This includes, but is not limited to, the locations where we hire remote, hybrid, or onsite employees.