{"id":392333,"url":"https://alion.io/job/onmed-senior-infrastructure-security-engineer","title":"Senior Infrastructure & Security Engineer","company":{"id":6689,"name":"OnMed","domain":"onmed.com","url":"https://alion.io/company/onmed","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["White Plains, United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":150000,"max":160000,"currency":"USD","period":"year","gross":null,"usd_annual":160000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"FedRAMP","optional":false},{"name":"HIPAA","optional":false},{"name":"ITSM","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"VPN","optional":false},{"name":"Zero Trust","optional":false},{"name":"Bicep","optional":true},{"name":"Cloudflare","optional":true},{"name":"ITIL","optional":true},{"name":"Jira","optional":true},{"name":"OWASP Top 10","optional":true},{"name":"Palo Alto NGFW","optional":true},{"name":"ServiceNow","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-09-03T00:00:00Z","employer_posted_date":"2026-09-03","last_verified_at":"2026-10-25T00:23:19Z","board_verified":true,"closed_at":null,"days_open":52,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":52},"description":"Who We Are and Why Join Us\nAt OnMed our purpose is simple but powerful...to improve the quality of life and sense of well-being in our communities by bringing access to healthcare to everyone, everywhere. Our path to everywhere has already begun, with our innovative CareStation, a small but mighty, Clinic-in-a-Box, bringing #healthcareaccess anywhere with an outlet to plug it in. Poised to become a key component in America’s public health infrastructure, the OnMed CareStation is the only tech-enabled, AI-powered, human-delivered, hybrid care solution that combines the comprehensive experience, trust and outcomes of a clinic, with the rapid scalability of virtual care.\nAt OnMed, every role, everyday, is directly impacting the communities we serve. You’ll join a high-performing purpose-driven team, innovating to break down the barriers that keep people from the care they need.\nThis is not just a job...it's a movement to bring access to healthcare where and when people need it most. It’s healthcare that shows up.\nWho You Are\nYou are a hands-on, deeply technical infrastructure engineer who treats security as part of the job rather than someone else’s department. You are fluent in the Microsoft Azure and Entra ecosystem, you understand networking and firewall rules cold, and you move comfortably between building cloud infrastructure, administering identity and endpoints, tuning detections in an XDR/SIEM console, working an incident to ground, and closing out a ticket queue. You automate what should be automated, you document as you go, and you would rather fix the underlying cause than absorb the same escalation twice.\nYou’ll be the front line dedicated engineer in this seat, working directly with the Head of Security and Infrastructure, who owns the architecture, the compliance program, and the vendor relationships. You take the operational reins: you’ll inherit an environment currently supported through an interim vendor engagement, so you’re someone who can work productively from imperfect documentation and improve it as you go. You thrive in a new, fast-paced, high-demand environment and take pride in the availability, security, and resilience of the systems that protect our patients’ healthcare data.\nThe Role\nThis is a hands-on infrastructure and security engineering role reporting to the Head of Security and Infrastructure. The role owns day-to-day Azure infrastructure and identity operations, IT service management, security engineering and incident response, the operational posture of customer- and public-facing endpoints, and compliance evidence and vendor coordination - taking over work currently supported through an interim vendor engagement.\nKey Responsibilities\nInfrastructure & Cloud Operations\nOwning day-to-day Microsoft Azure operations hands-on - resource configuration, patching, backup and recovery, monitoring, and cost and capacity hygiene. \nBuilding and maintaining infrastructure across cloud and on-prem, and automating provisioning and routine administration through scripting. \nAdministering identity and access in Entra ID - provisioning and deprovisioning, access reviews, privileged account audits, MFA/SSO enforcement, and vendor access processes. \nManaging endpoint administration and device hardening across corporate laptops, mobile, and field-deployed customer-facing systems. \nMaintaining and documenting network architecture in partnership with the Head of Security and Infrastructure - segmentation, firewall rule sets, VPN, and Zero Trust access for the remote workforce and field devices. \nIT Service Management\nRunning IT service management end to end: ticket intake, triage, assignment, escalation coordination, and resolution tracking across OnMed, its managed service providers, and other vendors - with clear SLAs and no dropped handoffs. \nServing as the technical escalation point for infrastructure and security issues, including after-hours events affecting internal systems and patient-facing endpoints. \nBuilding the runbooks, documentation, and self-service that reduce repeat tickets over time. \nSecurity Engineering & Operations\nDeploying, configuring, and managing security controls hands-on across cloud, network, and endpoint environments - implementing the architecture, not just monitoring it. \nHardening the Azure and M365/Entra environment - network security groups, firewall rules, conditional access, and encryption at-rest and in-transit across corporate, field, and customer-facing endpoints. \nOperating and tuning the security stack day to day: XDR/MDR, SIEM, and SOC workflows - refining detections, triaging alerts, and working them hands-on. \nExecuting incident response: triage, containment, eradication, root cause analysis, and documentation, escalating to the Head of Security and Infrastructure as severity warrants. \nRunning vulnerability management - scanning, prioritization, patch and configuration remediation, and tracking exceptions to closure. \nContributing to security review of integrations, vendor systems, and system designs, and partnering with engineering on remediation. \nCustomer- and Public-Facing Endpoint Fleet\nOwning the operational and security posture of customer- and public-facing endpoints deployed in unattended settings - device identity, network isolation, remote access, telemetry, physical tamper considerations, and secure update and recovery paths. \nPartnering with product and field operations teams so that manageability and security are designed into new endpoint deployments rather than retrofitted after they ship. \nCompliance Support & Vendor Coordination\nProducing and maintaining control evidence for SOC 2, HITRUST, FedRAMP, HIPAA, and related frameworks in support of the compliance program - refreshing evidence on cadence, responding to auditor and assessor requests, and tracking assigned findings through to remediation. \nImplementing HIPAA-scoped PHI handling practices: data classification, Security Rule technical safeguards, minimum necessary access, and breach notification readiness. \nServing as the day-to-day technical point of contact for managed service and managed security providers - coordinating work, escalating issues, and validating that deliverables actually landed. \nSupporting vendor and third-party risk assessment, security awareness training, and responses to customer and vendor security questionnaires. \nTransition & Stabilization (First 90 Days)\nTaking over the operational work currently covered by an interim vendor engagement, working alongside the Head of Security and Infrastructure through the handoff. \nBuilding out the asset, identity, and network documentation the environment is missing, and establishing the operating cadence for tickets, patching, access reviews, and evidence collection. \nRequirements\nKnowledge, Skills and Abilities\nMust Have:\nDeep, hands-on experience building, deploying, and operating infrastructure and security controls across multiple technology stacks - engineering it yourself, not directing others. \nStrong hands-on expertise with Microsoft Azure operations and security, and the M365/Entra ID stack - identity, network security, and workload protection. \nExcellent understanding of networking and firewall rules - segmentation, NGFW and Azure Firewall rule administration, VPN, IDS/IPS, and Zero Trust Network Access across remote users and field devices. \nPractical IT service management experience - working an ITSM platform and queue day to day, including intake, triage, escalation, and resolution tracking across internal teams and external vendors. \nEndpoint management and device hardening experience, with encryption at-rest and in-transit across cloud, corporate, and field-deployed devices. \nHands-on experience operating XDR/MDR, SIEM, and SOC environments - tuning detections and working alerts directly. \nHands-on incident response experience - triage, containment, root cause analysis, and documentation. \nVulnerability management experience - scanning, prioritizing, and driving remediation to closure. \nScripting and automation ability (e.g., PowerShell, Python, KQL) to automate administration, hardening, detection, and response. \nWorking knowledge of at least one major compliance framework (SOC 2, NIST, CIS, HITRUST, or FedRAMP) and practical experience producing control evidence for auditors. \nWorking knowledge of HIPAA-scoped PHI handling, data classification, and Security Rule technical safeguards. \nExperience coordinating with managed service or managed security providers as part of a small internal team. \nClear written communication and a documentation habit - this role writes runbooks, evidence narratives, and incident write-ups regularly. \nComfort working from imperfect documentation in a rapidly growing, fast-paced, high-demand environment. \nNice-to-Have:\nExperience securing IoT, embedded devices, or infrastructure deployed in unattended public settings. \nApplication security exposure - reviewing integrations, code, or system designs for vulnerabilities, with familiarity with the OWASP Top 10 and SAST/DAST tooling. \nDirect experience carrying an organization through a SOC 2, HITRUST, or FedRAMP audit or authorization cycle. \nHands-on experience with Palo Alto NGFW, Azure Firewall administration, and Cloudflare security services. \nAdvanced security operations automation (e.g., leveraging Elastic). \nExperience with ITSM platforms and endpoint/RMM tooling (e.g., ServiceNow, Jira Service Management, Freshservice, Microsoft Intune). \nExperience implementing and managing cloud service provider, SaaS, and PaaS security. \nInfrastructure-as-code experience (e.g., Terraform, Bicep, ARM). \nFamiliarity with securing AI tools and platforms in use across an organization, or with GRC and compliance tracking platforms. \nPrior healthcare or other regulated-industry experience. \nEducation and Experience\nBachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent practical experience. \n7+ years of hands-on experience across IT infrastructure and information security, preferably in a regulated industry. \n5+ years operating and securing cloud (Azure preferred) and on-prem environments hands-on. \nAZ-104, AZ-500, Security+, or CySA+ preferred; GSEC, GCIH, ITIL Foundation, or CISSP/CISM are good nice-to-haves. \nBenefits\nOnMed provides a competitive salary and benefits package, including unlimited PTO and paid holidays.\nThe base salary for this role is $150,000 - $160,000 commensurate with the candidate's experience.\nOnMed is a proud equal opportunity employer. All qualified applicants will be considered without regard to race, color, creed, religion, gender, sexual orientation, national origin, genetic information, disability, age, marital status, veteran status, or any other category protected by law.","description_format":"text","description_chars":10821,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":["Unlimited PTO"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Telemedicine & Virtual Care","Primary Care & Medical Centers"],"lifecycle":[{"event":"open","at":"2026-09-05T23:26:59Z"}],"visa":[],"liveness":{"score":31,"band":"fade","label":"Fading","p_open":1,"p_active":0.68,"p_room":0.45,"age_days":51,"expected_fill_days":30,"reasons":["conf:7","win:tail"],"computed_at":"2026-10-24T06:02:35Z"},"pay":{"stated_usd_annual":160000,"is_top_pay":false},"html_url":"https://alion.io/job/onmed-senior-infrastructure-security-engineer","json_url":"https://alion.io/job/onmed-senior-infrastructure-security-engineer.json","meta":{"generated_at":"2026-10-25T01:20:59Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2073,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6689},"rest":"https://alion.io/mcp/rest/get_company?id=6689"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fonmed-senior-infrastructure-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fonmed-senior-infrastructure-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fonmed-senior-infrastructure-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/onmed-senior-infrastructure-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fonmed-senior-infrastructure-security-engineer"}]}