Lead Security Engineer

Position Summary

The Lead Security Engineer provides hands-on technical leadership for American Oncology Network’s enterprise security program, overseeing security tools, configurations, monitoring, vulnerability management, incident response, and managed security service partners across a distributed healthcare environment. Reporting to the Director of IT Security, this role leads and develops a team of three security staff, strengthens the protection of patient information and clinical operations, and drives consistent security practices across AON locations.

Key Performance Areas

KPA 1: Security Engineering, Tools and Infrastructure

• Own and administer the security technology stack, including SIEM/SOAR, endpoint protection, email security, privileged access management, and secure network access.
• Maintain and optimize Rapid7 InsightIDR, InsightVM and InsightConnect, Bitdefender GravityZone, Mimecast, Delinea Secret Server, and Cato security configurations and coverage.
• Secure Microsoft 365, Azure and other cloud/SaaS environments by establishing configuration baselines and monitoring security posture.
• Manage security tool licensing, coverage, and renewal inputs to maintain appropriate protection and cost-effective utilization.

KPA 2: Threat Detection, Incident Response and Vulnerability Management

• Lead security event triage and incident investigations in partnership with the managed detection and response provider; coordinate containment, recovery, and post-incident reviews.
• Oversee vulnerability scanning, prioritization, remediation, and patch management across endpoints, servers, cloud platforms, and network infrastructure.
• Document risks associated with legacy systems and validate compensating controls where timely remediation is not feasible.
• Develop response runbooks, technical standards, and repeatable procedures to support consistent security operations.

KPA 3: Identity, Access and Security Risk Compliance

• Strengthen identity and access security through multifactor authentication, conditional access, privileged access management, joiner/mover/leaver controls, and periodic access reviews.
• Coordinate annual HIPAA- and NIST-aligned security risk assessments, vulnerability assessments, and penetration tests with external assessment partners.
• Track and drive remediation of assessment findings and security gaps, communicating technical risks and priorities to stakeholders.
• Assess security risks arising from third-party vendors, integrations, newly onboarded sites, and acquired practices.

KPA 4: Vendor and Managed Security Partner Oversight

• Serve as the technical lead and primary day-to-day accountability point for managed service and security partners, including ATG and Rapid7 MDR.
• Validate provider deliverables, service quality, investigation work, and adherence to contractual service-level agreements.
• Escalate gaps and coordinate corrective action with internal IT stakeholders and external partners.
• Promote clear documentation, ownership, and communication across security operations and partner workflows.

KPA 5: Team Leadership and Operational Improvement

• Lead, mentor, and develop security staff by establishing priorities, reviewing deliverable quality, and building technical capabilities.
• Provide practical guidance during complex security investigations, remediation activities, and operational issues.
• Identify opportunities to improve security workflows through PowerShell, Python, and other scripting or automation methods.
• Communicate security risks, operational priorities, and remediation progress clearly to nontechnical leaders and clinical stakeholders.