SENIOR SECURITY ENGINEER
$155,563–$179,712 year
On-site · Daly City, California, United States
Job Summary
Senior Security Engineer responsible for designing, implementing, and governing NEMS enterprise security architecture across clinic sites, data centers, and cloud infrastructure. Operates within a hybrid multi-site environment with HIPAA and NIST-aligned standards, acting as a hands-on technical leader collaborating with external security vendors, cloud providers, and internal teams to architect and enforce a cohesive Zero-Trust security environment. Focuses on IAM governance, endpoint protection, lifecycle management, security policy development and enforcement, SOC coordination, and continuous compliance monitoring across endpoints and data centers. Responsibilities include defining security baselines and governance for identity management, endpoint protection, network controls, encryption, and compliance; deploying cloud IAM (Azure AD/Entra ID) and hybrid IAM; enforcing MFA and PAM; conducting IAM audits; deploying EDR; implementing Zero-Trust Network Access policies; developing policies per NIST CSF, NIST 800-53, HIPAA/HITECH; performing quarterly risk and vulnerability assessments; coordinating incident response and tabletop exercises; maintaining documentation for regulatory audits; mentoring junior staff; staying current with threats and regulatory changes; and serving as liaison with external vendors.
Required Qualifications
- Bachelor's Degree in Cybersecurity, Computer Science, Information Technology, Information Security, or a related STEM field required
- Equivalent combination of 8+ years of directly relevant security engineering and IAM experience may be substituted for degree requirement
- Certified Information Systems Security Professional (CISSP) is required
- Minimum 5 years of enterprise security engineering experience including architecture design, security policy governance, hands-on technical implementation, and demonstrated security leadership owning outcomes across infrastructure, applications, and networks
- Minimum 3 years of hands-on experience in each of the following: designing and implementing identity and access management; designing and implementing endpoint detection and response solutions; developing and maintaining security policies aligned to NIST or ISO 27001 frameworks; and coordinating with external security vendors, SOCs, and managed security service providers
- Demonstrated experience conducting security risk assessments, vulnerability management, and threat analysis
- Demonstrated experience with incident response coordination, root cause analysis, and post-incident reviews
- Demonstrated experience with healthcare compliance frameworks including HIPAA Security Rule and HITECH requirements
- Experience in healthcare information technology or Federally Qualified Health Center (FQHC) environments preferred
- Must be able to read and write English
- Ability to speak and/or understand Chinese (Cantonese or Mandarin) is an asset
- Must be able to read, write, and speak English fluently
- Ability to speak and/or understand Chinese (Cantonese or Mandarin) is an asset
Apply with one swipe on Sorce. We auto-fill applications and apply on your behalf — no cover letters, no 40-minute forms.
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.