{"id":2445098,"url":"https://alion.io/job/smartlinx-lead-cybersecurity","title":"Lead, Cybersecurity","company":{"id":2592327,"name":"Smartlinx","domain":"smartlinx.com","url":"https://alion.io/company/smartlinx-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Paylocity","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":106000,"max_usd":240000,"period":"year","method":"global_role_seniority_cell","sample_n":588},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"CI/CD","optional":false},{"name":"Configuration Management","optional":false},{"name":"CVSS","optional":false},{"name":"CWE","optional":false},{"name":"DLP","optional":false},{"name":"ETL/ELT","optional":false},{"name":"HIPAA","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Fabric","optional":false},{"name":"OWASP","optional":false},{"name":"SBOM","optional":false},{"name":"SIEM","optional":false},{"name":"Snowflake","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-09-17T19:03:02Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-14T13:46:18Z","board_verified":true,"closed_at":null,"days_open":26,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":26},"description":"Description\nSince 2000, Smartlinx has been redefining how senior care organizations manage their workforce. Our modern, purpose-built solutions from dynamic scheduling and compliance to integrated payroll and real-time analytics give providers the agility and intelligence needed to thrive in today's healthcare environment.\nAs the parent company of BekTek (HostedTime) and StafferLink, Smartlinx brings together a wide range of solutions for managing both full-time and contingent staff. Together, these capabilities give Smartlinx the most comprehensive workforce management solution set in senior care.\nWe are driven by one mission: to power exceptional senior care through smarter workforce management. Join us as we shape the future of work in long-term care.\nAbout the Role\nReporting to the Head of IT, the Lead, Cybersecurity is responsible for defining and operating Smartlinx's cybersecurity program across its multi-tenant SaaS products, cloud infrastructure, corporate technology environment, data platforms, integrations, and third-party services.\nThis leader owns SaaS product and application security, cloud and infrastructure security, identity and access management, vulnerability management, security monitoring, incident response, third-party risk, and SOC 2 Type II readiness and audit execution. The role is accountable for protecting sensitive healthcare workforce, payroll, personally identifiable information, and customer data while enabling reliable and timely product delivery.\nThe Lead, Cybersecurity will partner closely with Product, Engineering, Architecture, Quality Assurance, DevOps, Data Engineering, Corporate IT, Compliance, Legal, Customer Support, and Customer Success to integrate security into design, development, deployment, operations, and customer commitments.\nSuccess in this role requires a hands-on, pragmatic security leader who can translate business and regulatory requirements into effective technical controls, personally investigate risk and incidents, drive remediation to closure, and communicate clearly with executives, auditors, customers, and technical teams.\n Key Responsibilities\nSaaS Product and Application Security\nOwn the product-security strategy and operating model across the Smartlinx, BekTek (HostedTime), and StafferLink product portfolio. \nEmbed security throughout the product development lifecycle, including requirements, architecture, design, development, testing, release, and production operation. \nLead threat modeling, security architecture reviews, abuse-case analysis, and risk assessments for new products, features, APIs, integrations, mobile applications, and material platform changes. \nEstablish secure coding standards and engineering guidance based on OWASP, CWE, API security, and relevant industry practices. \nIntegrate automated security testing into CI/CD pipelines, including static application security testing, dynamic application security testing, software composition analysis, secrets scanning, infrastructure-as-code scanning, container scanning, and software bill of materials generation. \nReview and strengthen authentication, authorization, role-based access control, session management, tenant isolation, API security, file handling, encryption, audit logging, and secure data-export capabilities. \nPlan and coordinate independent application and API penetration testing, validate findings, assign risk-based remediation deadlines, and confirm closure through retesting. \nAssess AI-enabled product capabilities and third-party AI services for prompt injection, data leakage, tenant isolation, model access, sensitive-data handling, human oversight, and other emerging risks. \nDefine proportionate release-security gates and exception processes that protect customers without creating unnecessary friction for engineering delivery. \nCloud and Infrastructure Security\nLead security architecture and control implementation for Smartlinx's Microsoft Azure cloud environments, production and non-production infrastructure, corporate systems, endpoints, networks, and remote-work capabilities. \nEstablish secure cloud baselines using recognized frameworks and vendor guidance; continuously identify and remediate configuration drift, exposed services, excessive permissions, unsupported software, and insecure defaults. \nStrengthen network security through segmentation, private connectivity, firewall and security-group governance, DDoS protection, secure administrative access, and controlled ingress and egress. \nImplement and govern secrets management, certificate management, encryption, key rotation, secure service identities, and protection of privileged credentials across applications and infrastructure. \nPartner with DevOps and Corporate IT to maintain effective patching, endpoint protection, malware defense, vulnerability scanning, cloud security posture management, and secure configuration management. \nReview the security of databases, data lakes, warehouses, analytics platforms, ETL and ELT pipelines, customer data exchanges, backups, and disaster-recovery environments. \nEnsure logging, telemetry, alerting, and forensic data are available across cloud resources, applications, identities, endpoints, networks, and data platforms to support timely detection and investigation. \nAssess resilience to destructive cyber events, including ransomware and credential compromise, and validate recoverability through protected backups, restoration tests, and cyber-recovery exercises. \nSOC 2, Healthcare Compliance, and Audit Readiness\nLead Smartlinx's SOC 2 Type II readiness, control design, evidence collection, auditor coordination, remediation, management responses, and annual attestation cycle. \nBuild a continuous-control-monitoring program that keeps the organization audit-ready throughout the year rather than relying on a point-in-time preparation effort. \nDefine, document, test, and improve controls across access management, change management, secure software development, vulnerability management, incident response, vendor risk, data protection, and business continuity. \nMaintain the control matrix, security policies, standards, procedures, risk register, evidence repository, exception records, remediation plans, and executive compliance reporting. \nApply healthcare security and privacy requirements, including HIPAA and HITECH, to product, infrastructure, operational, vendor, and data-handling decisions; support business associate and customer contractual obligations. \nEvaluate alignment with NIST, CIS Controls, ISO 27001, and HITRUST expectations where they strengthen the security program or support customer and market requirements. \nCoordinate effectively with external auditors, penetration-testing providers, legal counsel, cyber-insurance partners, customers, and other independent assessors. \nLead or support responses to customer security questionnaires, due-diligence reviews, contractual security requirements, and customer audit requests with accurate, consistent, and timely information. \nVulnerability, Risk, and Third-Party Security\nEstablish a unified vulnerability-management program covering SaaS applications, APIs, cloud infrastructure, endpoints, containers, databases, open-source components, and third-party software. \nPrioritize remediation using severity, exploitability, exposure, asset criticality, data sensitivity, customer impact, compensating controls, and active-threat intelligence rather than relying on CVSS scores alone. \nDefine measurable remediation service-level targets for critical, high, medium, and low-risk findings; monitor aging, exceptions, recurrence, and closure quality. \nOwn formal security-risk acceptance, exception, escalation, and expiration processes, ensuring material risks receive appropriate executive visibility and approval. \nConduct periodic enterprise, product, cloud, and data-security risk assessments and translate findings into prioritized, funded remediation roadmaps. \nEvaluate vendors, subprocessors, managed services, technology partners, and AI providers for security, privacy, resilience, data handling, incident notification, and contractual risk before onboarding and throughout the relationship. \nMonitor changes in the threat landscape, exploited vulnerabilities, attack techniques, and healthcare-sector risks; convert relevant intelligence into actionable protections and tests. \nSecurity Operations, Incident Response, and Resilience\nDefine and operate security monitoring across applications, cloud infrastructure, identities, endpoints, networks, databases, and data platforms using SIEM, EDR, WAF, and related capabilities. \nDevelop high-value detection use cases for account compromise, privilege escalation, anomalous access, data exfiltration, malicious application activity, insecure configuration changes, and other material threats. \nOwn the cybersecurity incident-response plan, severity model, escalation paths, on-call expectations, investigation procedures, communications protocols, evidence handling, and post-incident review process. \nLead or coordinate containment, eradication, recovery, forensic analysis, customer-impact assessment, regulatory and contractual notification support, and executive communication during security incidents. \nConduct regular tabletop exercises involving executive leadership, Engineering, DevOps, IT, Legal, Compliance, Customer Support, Customer Success, and Communications; document gaps and drive corrective actions to closure. \nTrack and improve security operational measures such as mean time to detect, acknowledge, contain, recover, and permanently remediate incidents and recurring control failures. \nEstablish relationships and operating procedures with external incident-response, forensic, legal, insurance, and specialized security partners before an incident occurs. \nIdentity, Data Protection, and Privacy by Design\nEstablish an identity-first security model based on least privilege, multifactor authentication, privileged access management, separation of duties, conditional access, and periodic access certification. \nStrengthen joiner, mover, and leaver processes for employees, contractors, service accounts, customer support access, production access, and privileged roles. \nDefine and govern security controls for Microsoft Entra ID, application identities, API credentials, machine accounts, emergency access, and third-party access. \nPartner with data owners, Product, Legal, Compliance, and Engineering to implement data classification, minimum-necessary access, encryption, masking, retention, deletion, and secure disposal. \nProtect sensitive healthcare workforce, payroll, tax, financial, personally identifiable, and authentication data throughout collection, processing, storage, transmission, sharing, export, backup, and disposal. \nImplement data-loss-prevention controls and monitoring appropriate to corporate systems, SaaS products, data platforms, collaboration tools, endpoints, and customer data-sharing workflows. \nIncorporate privacy and security by design into product decisions, integration patterns, analytics, AI use cases, customer implementations, and vendor engagements. \nSecurity Governance, Leadership, and Performance Management\nDevelop and execute a practical, risk-based cybersecurity strategy, annual operating plan, budget, staffing model, and multiyear roadmap aligned with Smartlinx's product and business priorities. \nDefine clear security ownership, decision rights, standards, escalation paths, and measurable objectives across Product, Engineering, DevOps, Data Engineering, Corporate IT, and business functions. \nCreate executive and Board-level security reporting that clearly communicates material risks, incidents, audit readiness, remediation progress, control effectiveness, investment needs, and business tradeoffs. \nEstablish a concise cybersecurity scorecard covering critical exposure, remediation aging, secure-development adoption, privileged access, control p...","description_format":"text","description_chars":15835,"description_truncated":true,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Professional Services","Human Resources"],"lifecycle":[{"event":"open","at":"2026-10-13T13:21:42Z"}],"visa":[],"liveness":{"score":39,"band":"fade","label":"Fading","p_open":1,"p_active":0.709,"p_room":0.55,"age_days":26,"expected_fill_days":26,"reasons":["conf:3","win:tail"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/smartlinx-lead-cybersecurity","json_url":"https://alion.io/job/smartlinx-lead-cybersecurity.json","meta":{"generated_at":"2026-10-14T16:23:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":20846,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2592327},"rest":"https://alion.io/mcp/rest/get_company?id=2592327"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsmartlinx-lead-cybersecurity"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsmartlinx-lead-cybersecurity"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsmartlinx-lead-cybersecurity"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/smartlinx-lead-cybersecurity\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsmartlinx-lead-cybersecurity"}]}