Senior Security Engineer

To create a healthcare system with effective health information exchange, healthcare organizations need more than a series of connections between each other. They need assurance that the data being exchanged is meaningful and to know it will be delivered when and where they need it.

Founded in 2014, Health Gorilla provides access to actionable patient data, supporting a diverse set of clinical use cases and improving outcomes across the country. We work with some of the leading companies in health IT, value-based care, and digital health, including Virta Health, The Garage, Medhost, and many others. Health Gorilla is one of the five original organizations approved as a Qualified Health Information Network (QHIN) and the only QHIN to also be designated as a Qualified Health Information Organization (QHIO).

As a Senior Security Engineer at Health Gorilla, you will help secure platforms that power nationwide health data exchange, protect patient privacy, and ensure compliance in a cloud-native, high-scale environment. You’ll implement information security strategies and procedures, executing solutions that align with our architectural designs, industry best practices, and regulatory requirements such as HIPAA and TEFCA. As risks evolve, you\u2019ll play a key role in proactively recommending modifications and enhancements to strengthen our security posture and identify opportunities for continuous improvement.

What you will do at Health Gorilla :

• Work with our engineering teams to define / refine information security systems management policies and settings.
• Conduct vendor and 3rd party information security audits and help with security questionnaires.
• Perform security analysis and risk assessments to identify threats and vulnerabilities, and work with engineering teams to document and remediate issues to safeguard information assets.
• Create AWS Cloud Formation templates, Ansible scripts and automation with AWS Systems Manager.
• Hands-on expertise with AWS-native security services including GuardDuty, Security Hub, Macie, Inspector, IAM, KMS, CloudTrail, and Config to design, monitor, and enforce security controls in a healthcare cloud environment.
• Experience implementing identity and access management best practices in AWS (least privilege, service control policies, cross-account roles, and MFA enforcement) to ensure HIPAA compliance.
• Proven ability to architect and operationalize security guardrails via AWS Config rules, SCPs, and automation (e.g., Lambda functions, EventBridge) for continuous compliance.
• Demonstrated skill in monitoring and incident detection using GuardDuty findings, CloudWatch alerts, and CloudTrail logs , integrating with SIEM / SOAR platforms.
• Proficiency in deploying, tuning, and managing CrowdStrike Falcon EDR for endpoint visibility, prevention, and real-time response across cloud and enterprise environments.
• Experience with threat hunting and investigation using CrowdStrike telemetry, Falcon OverWatch, and custom queries to detect advanced threats.
• Knowledge of malware analysis and incident response leveraging CrowdStrike’s real-time response capabilities, forensic data, and threat intelligence.
• Partner with other Cybersecurity, Engineering, and Product teams to align detection strategies with organizational objectives.
• Ensure all detection processes and tools adhere to regulatory requirements and industry standards (e.g., HIPAA, GDPR, PCI-DSS, NIST).
• Central point of contact for 3rd party audits (SOC2, ISO, HIPAA, HITRUST), and other GRC functions

What you bring to the role :

What You Will Love About Us!

Equal Opportunity

Health Gorilla is an equal opportunity employer. Applicants will not be discriminated against because of race, color, creed, sex, sexual orientation, gender identity or expression, age, religion, national origin, citizenship status, disability, ancestry, marital status, veteran status, medical condition, genetic information, or any protected category prohibited by local, state or federal laws.

#J-18808-Ljbffr