Senior Information Security Engineer

The Role We’re looking for a Senior Information Security Engineer to strengthen security across our cloud infrastructure, Microsoft 365 environment, endpoints, and business applications. This is a hands-on, senior individual contributor role with ownership of security engineering, threat detection, incident response, vulnerability management, and technical controls supporting our SOC 2 Type II and HIPAA compliance objectives.

About Auctus

• Procode AI Who We Are ProCode AI operates at the intersection of healthcare, technology, and revenue cycle management.
• We support healthcare organizations through technology-enabled services, cloud-based applications, and integrated business operations.
• Protecting sensitive healthcare information and maintaining secure, reliable systems are essential to our work.
• As we grow, this role will help strengthen the security capabilities that support our business and our clients.

Responsibilities

• Reporting to the VP of Technology, you’ll work closely with IT, Engineering, and Compliance to identify risks, implement practical solutions, and verify that security controls work effectively.
• The initial focus will be approximately 60% security engineering and operations and 40% technical controls, assurance, and audit readiness .
• You’ll have the opportunity to shape our security capabilities and turn security requirements into measurable technical improvements.
• You’ll Do Design, implement, and maintain security controls across cloud, network, endpoint, identity, and application environments.
• Strengthen Microsoft 365 and Microsoft Entra ID security, including multifactor authentication, Conditional Access, privileged access, and periodic access reviews.
• Investigate security alerts and incidents, perform root-cause analysis, and develop response playbooks and escalation procedures.
• Assess vulnerabilities and security configurations across Windows, macOS, cloud, and virtualized environments, partnering with IT and Engineering to prioritize and verify remediation.
• Improve centralized logging, threat detection, alerting, and log retention to support effective security monitoring and investigations.
• Automate security checks, reporting, investigations, and evidence collection using scripts, APIs, and appropriate security tools.
• Implement, test, and document technical controls supporting SOC 2 Type II and HIPAA requirements, working with Compliance and audit stakeholders.
• Assess security risks involving vendors, SaaS applications, third-party integrations, and AI-enabled systems, including those handling protected health information (PHI).
• Maintain clear incident records, control evidence, and remediation tracking, and communicate security priorities and progress to leadership.

Requirements

• At least 5 years of hands-on experience in information security engineering, cloud security, security operations, or a related technical security role.
• Demonstrated experience securing Microsoft 365 and Microsoft Entra ID environments.
• Strong understanding of enterprise security architecture, identity management, endpoint protection, and cloud security controls.
• Hands-on experience with endpoint detection and response (EDR), vulnerability management, centralized logging, and security incident investigation.
• Experience implementing and validating technical security controls, with working knowledge of SOC 2 Type II and the HIPAA Security Rule .
• Ability to develop scripts and automation using technologies such as PowerShell, Python, Microsoft Graph, KQL, or equivalent tools.
• Strong troubleshooting, documentation, and risk-prioritization skills.
• Ability to work independently, collaborate across technical and compliance teams, and explain security risks clearly to nontechnical stakeholders.
• We’re looking for an engineer who takes ownership, solves problems, and follows through from identifying a risk to implementing and validating a solution.
• You’ll thrive here if you enjoy hands-on technical work, communicate clearly, collaborate across teams, and take pride in building security practices that are practical, repeatable, and effective.
• If you’re ready to help shape security within a growing healthcare technology organization, we’d like to hear from you.

Preferred

• Qualifications Experience supporting healthcare organizations, healthcare technology companies, or environments that process PHI.
• Experience securing AWS and virtualized infrastructure, including networking, firewall, and backup and recovery controls.
• Familiarity with Microsoft Defender, Sentinel, Purview, or comparable security monitoring, data protection, endpoint management, and compliance automation tools.
• Experience with continuous control monitoring, audit evidence collection, and security integrations through REST APIs.
• Experience assessing security risks in AI-enabled applications, agents, or automated workflows.
• Relevant certifications such as CISSP, CISM, CCSP, CompTIA Security+, or Microsoft security certifications.
• Certifications are valued, with demonstrated technical capability and practical experience central to this role.