Security Engineer II
Iovance Biotherapeutics
Summary
We are seeking a hands-on Security Engineer with strong technical depth across endpoint, cloud, identity, and email security. This role designs, deploys, and operates Iovance's core security platforms, including CrowdStrike Falcon EDR and Next-Gen SIEM, privileged access management, Mimecast, AWS security services, and GitHub security. The right candidate builds policy, writes detections and automation, troubleshoots across the stack, and documents their work to the standard expected in a validated, audit-ready environment.
Job description
Overview
We are seeking a hands-on Security Engineer with strong technical depth across endpoint, cloud, identity, and email security. This role designs, deploys, and operates Iovance's core security platforms, including CrowdStrike Falcon EDR and Next-Gen SIEM, privileged access management, Mimecast, AWS security services, and GitHub security. The right candidate builds policy, writes detections and automation, troubleshoots across the stack, and documents their work to the standard expected in a validated, audit-ready environment.
Essential Functions and Responsibilities
Endpoint Detection, SIEM & Response (CrowdStrike)
- Administer and tune CrowdStrike Falcon prevention policies, host groups, device control, and sensor updates across Windows, macOS, and Linux, with careful exclusion management for GxP and manufacturing systems.
- Onboard and normalize log sources (Okta, AWS, Mimecast, GitHub, PAM, servers) into Falcon Next-Gen SIEM, and build detections, dashboards, and Falcon Fusion SOAR workflows.
- Investigate alerts, conduct threat hunting, and drive containment and remediation.
Privileged Access Management
- Operate the enterprise PAM platform, including vaulting, credential rotation, session recording, and just-in-time access for servers, cloud accounts, databases, and service accounts.
- Integrate PAM with Okta and Active Directory, and support privileged access reviews and segregation-of-duties controls.
Email Security (Mimecast)
- Administer Mimecast targeted threat protection, DLP, archiving, and continuity policies, and maintain SPF, DKIM, and DMARC.
- Investigate phishing, impersonation, and business email compromise attempts.
Cloud & DevSecOps Security (AWS, Microsoft 365 & GitHub)
- Secure AWS workloads including EC2, ECS, ELB/ALB, S3, and VPC networking, using AWS WAF, IAM, KMS, GuardDuty, Security Hub, Config, and CloudTrail.
- Identify and remediate misconfigurations, enforce least privilege, and review infrastructure-as-code (Terraform/CloudFormation).
- Harden and monitor Microsoft 365, including Entra ID Conditional Access, Exchange Online, SharePoint/OneDrive/Teams sharing controls, Microsoft Purview DLP and sensitivity labels, and Microsoft Secure Score recommendations.
- Administer GitHub Advanced Security (code scanning, secret scanning, Dependabot), branch protection, and organization policies, and secure GitHub Actions pipelines using OIDC federation to AWS.
Governance, Compliance & Operations
- Author technical documentation, standards, and runbooks suitable for GxP, SOX, and HIPAA audits, and provide audit evidence.
- Participate in change control, vulnerability and patch management, incident response, and on-call rotation.
Requirements
- Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent experience
- 5+ years of hands-on experience in security engineering or cloud security
- Hands-on experience with CrowdStrike Falcon EDR and a SIEM platform, preferably Falcon Next-Gen SIEM (LogScale), including detection development
- Experience administering an enterprise PAM solution (e.g., CyberArk, BeyondTrust, Delinea)
- Experience with Mimecast or a comparable secure email gateway
- Practical experience securing AWS environments (EC2, ECS, ELB, S3, WAF, IAM, VPC)
- Hands-on experience securing Microsoft 365, including Entra ID, Conditional Access, Exchange Online, and Purview
- Working knowledge of GitHub security features and CI/CD security
- Solid foundation in networking, DNS, TLS, and identity protocols (SAML, OIDC, OAuth, LDAP)
- Scripting experience in Python, PowerShell, or Bash
- Strong written communication and audit-ready documentation skills
Benefits
- Remote work
- On-call rotation
Company overview
Iovance Biotherapeutics is a pioneering biotechnology company focused on developing innovative tumor infiltrating lymphocyte (TIL) therapies for cancer treatment. Founded in 2007 and headquartered in San Carlos, California, the company aims to be the global leader in innovating, developing, and delivering personalized cell therapies for patients with cancer. Iovance's transformational approach harnesses the human immune system's ability to recognize and attack diverse cancer cells in each patient through their proprietary TIL platform. The company's lead investigational therapy, lifileucel, has demonstrated promising clinical data across multiple solid tumors including melanoma, cervical cancer, and non-small cell lung cancer. Iovance operates a state-of-the-art 136,000-square-foot Cell Therapy Center in Philadelphia for manufacturing their therapies using proprietary good manufacturing practices. As a publicly traded company (NASDAQ: IOVA), Iovance maintains a patient-centric, collaborative culture with a workforce of 501-1,000 employees dedicated to advancing next-generation cancer immunotherapies.