Senior Security Engineer, Health Gorilla
$159-180k
+ Stock option grant
Healthcare API provider
Be an early applicant
Healthcare API provider
101-200 employees
Be an early applicant
$159-180k
+ Stock option grant
101-200 employees
Company mission
To build a single national network that can retrieve and house all health data on any patient, ranging from medical records and labs to social determinants of health.
Role
Who you are
- Expert level experience with Linux operating system and AWS ecosystems
- Experience operating in highly regulated environments (e.g., HIPAA, HITRUST, SOC 2), with a strong understanding of compliance-driven security controls and documentation requirements
- 7+ years conducting security work in enterprise infrastructure or cloud environments (AWS experience a plus)
- 3+ years working with any of the following: intrusion detection systems, remote access VPN technologies, vulnerability assessment tools, event and log analysis solutions and configuration and change management systems
- Possess knowledge of SIEM implementation and log ingestion, SOAR, Incident Response, and Threat Intelligence that will be data-driven with strong verbal, written communication, and leadership skills
- Strong experience with Information Security, Network Security, Security Monitoring, Incident Response, Auditing
- RFP/RFI Response Knowledge (ability to work and support proposal efforts)
- Certifications in information technology security such as AWS Security, AWS Associate Level certification, CISSP or CCSP
- Bachelor's degree in Computer Science or equivalent work experience
What the job involves
- As a Senior Security Engineer at Health Gorilla, you will help secure platforms that power nationwide health data exchange, protect patient privacy, and ensure compliance in a cloud-native, high-scale environment
- You’ll implement information security strategies and procedures, executing solutions that align with our architectural designs, industry best practices, and regulatory requirements such as HIPAA and TEFCA
- As risks evolve, you'll play a key role in proactively recommending modifications and enhancements to strengthen our security posture and identify opportunities for continuous improvement
- Work with our engineering teams to define/refine information security systems management policies and settings
- Conduct vendor and 3rd party information security audits and help with security questionnaires
- Perform security analysis and risk assessments to identify threats and vulnerabilities, and work with engineering teams to document and remediate issues to safeguard information assets
- Create AWS Cloud Formation templates, Ansible scripts and automation with AWS Systems Manager
- Hands-on expertise with AWS-native security services including GuardDuty, Security Hub, Macie, Inspector, IAM, KMS, CloudTrail, and Config to design, monitor, and enforce security controls in a healthcare cloud environment
- Experience implementing identity and access management best practices in AWS (least privilege, service control policies, cross-account roles, and MFA enforcement) to ensure HIPAA compliance
- Proven ability to architect and operationalize security guardrails via AWS Config rules, SCPs, and automation (e.g., Lambda functions, EventBridge) for continuous compliance
- Demonstrated skill in monitoring and incident detection using GuardDuty findings, CloudWatch alerts, and CloudTrail logs, integrating with SIEM/SOAR platforms
- Proficiency in deploying, tuning, and managing CrowdStrike Falcon EDR for endpoint visibility, prevention, and real-time response across cloud and enterprise environments
- Experience with threat hunting and investigation using CrowdStrike telemetry, Falcon OverWatch, and custom queries to detect advanced threats
- Knowledge of malware analysis and incident response leveraging CrowdStrike’s real-time response capabilities, forensic data, and threat intelligence
- Partner with other Cybersecurity, Engineering, and Product teams to align detection strategies with organizational objectives
- Ensure all detection processes and tools adhere to regulatory requirements and industry standards (e.g., HIPAA, GDPR, PCI-DSS, NIST)
- Central point of contact for 3rd party audits (SOC2, ISO, HIPAA, HITRUST), and other GRC functions
Our take
With speed essential for good healthcare, the modern healthcare ecosystem relies on patients, providers, and laboratories being able to share health data quickly. Health Gorilla is a healthcare API provider that aims to streamline the process of pulling patient information from clinical records systems by putting it all in one place.
Health Gorilla has facilitated the exchange of millions of clinical documents for digital health developers. It sits within the growing healthcare informatics market, where it has secured a list of clients that includes Heal, WellVia, and IntellaTriage.
The company has also consistently launched new platform capabilities, such as electronic test ordering which allows healthcare providers to order and retrieve tests for their patients, within their EMR. This is just one example of how its tool suite creates value for providers and ultimately patients.
Freddie
Company Specialist at Welcome to the Jungle
Insights
40% employee growth in 12 months
Company
Funding (last 2 of 7 rounds)
Mar 2022
$50m
SERIES C
Mar 2021
$15m
SERIES B
Total funding: $78.3m
Company benefits
- Bonus program, 401(k) matching, and stock options
- Comprehensive coverage, including health, dental, vision, disability, life, and optional pet insurance
- Flexible vacation policy, so you can take as much time off as you need
- Work from home or come to one of our offices in Mountain View, California, Denver, Colorado, and Miami, Florida – or a hybrid of the two
Company HQ
Old Mountain View, Mountain View, CA
Leadership
Steve Yaskin
(Founder & CEO)Background in Physics. Was a Lead Consultant at Convansys, and CEO of Priority Consulting. Joined Pfizer as Technical Project Lead and founded software company Queplix. Is a member of Forbes's Technology Council.
Share this job