{"id":4182269,"url":"https://alion.io/job/third-way-health-information-security-analyst-security-operations-platforms","title":"Information Security Analyst (Security Operations & Platforms)","company":{"id":685161,"name":"Third Way Health","domain":"thirdway.health","url":"https://alion.io/company/thirdway","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Rippling","truth_index":{"grade":"B","score":75,"open_postings":3,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Medellín, Colombia"],"countries":["CO"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"DLP","optional":false},{"name":"Google Workspace","optional":false},{"name":"HIPAA","optional":false},{"name":"Least Privilege","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"ISO 27001","optional":true}],"status":"live","first_seen_at":"2026-11-12T17:18:46Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-12T17:40:36Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Who we are:\nThird Way Health helps medical practices across the United States improve the patient experience while reducing the administrative burden on practice owners. We enable practices to enhance the experience of their patients by providing them with a leading service automation platform and a world class team of service representatives. What unites us is our passion to support physicians and provide better access for patients from all backgrounds.\nAbout the position:\nThis role keeps TWH's security platforms configured, covered and healthy, and acts on what they detect. It is an operational role: you apply the platform baselines and standards, and you are the first responder to security alerts, using automation and integrations to do it at scale.\nAs a healthcare organization under HIPAA and SOC 2 Type II, TWH needs alerts handled consistently and evidenced.\nKey responsibilities\nSecurity platform administration\nApply policies and maintain configuration, coverage and health of the EDR, data-loss prevention (DLP), MDM, and vulnerability-management platforms, keeping them consistent across countries.\nOversee network security devices (firewalls, switches): accountable for secure configuration while vendors execute approved changes.\nProvide technical L2 support for security-platform issues that L1 cannot resolve.\nAlert triage and handling\nTriage alerts and detections from all security platforms: classify, enrich and prioritize by severity and business impact.\nInvestigate and resolve or contain confirmed alerts using agreed playbooks, and help write and maintain those playbooks with the Information Security Lead; document every outcome.\nTune detections and rules to reduce false positives and close coverage gaps.\nEscalate major incidents to the Information Security Lead.\nUses approved AI tools to support alert triage, investigation, documentation and automation, applying the same security and data-handling standards as any other system.\nUse approved AI tools to support triage and investigation, with human validation of every decision.\nAutomation and integrations\nIntegrate security platforms with each other and with the ticketing system (APIs, webhooks, scripting) so alerts reach one consistent workflow.\nAutomate enrichment, routing and repetitive response actions; document and maintain each automation.\nUses approved AI tools to support alert triage, investigation, documentation and automation, applying the same security and data-handling standards as any other system.\nIdentity, access and audit support\nAdminister and monitor the identity platform (Google Workspace) as one of the security platforms, applying the security and conditional-access settings defined by the Information Security Lead.\nProvision and remove vendor access (least-privilege, time-bound, logged) according to the established standard, and execute periodic access reviews.\nTrack vulnerability remediation and collect alert, access-review and posture evidence to support SOC 2 Type II and HIPAA audits.\nRequirements\nDegree in Systems, Computer or a related field, or equivalent experience.\n3-5 years in IT security, at least 2 of them in security operations (handling alerts or operating security tooling).\nHands-on administration of at least two of: EDR, DLP, vulnerability management or MDM.\nAlert triage and investigation: log analysis and incident-response fundamentals.\nBasic scripting (Python or equivalent) to automate repetitive tasks.\nIdentity and access fundamentals: Google Workspace administration, least privilege, access reviews.\nFirewall and network security basics.\nTicketing tools and security reporting.\nFamiliarity with HIPAA safeguards and SOC 2 controls.\nSoft skills\nDocuments every alert decision so another analyst can repeat it.\nPrioritizes by risk and business impact when several alerts compete, and explains the reasoning.\nWorks strictly within assigned permissions when handling sensitive data and privileged access, and reports own mistakes promptly.\nSpots repetitive tasks and proposes or builds an automation for them.\nCommunicates clearly in Spanish and English with service providers and stakeholders in several countries, and asks for clarification when instructions are ambiguous.\nNice to have\nExperience in a regulated environment (healthcare / HIPAA, SOC 2, PCI or similar).\nSecurity+, CySA+ or ISO 27001 foundation certification, or similar.\nGoogle Workspace Administrator certification.\nExperience building API/webhook integrations between security tools and ticketing systems, or low-code workflow automation.","description_format":"text","description_chars":4564,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Spanish","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Telemedicine & Virtual Care"],"lifecycle":[{"event":"open","at":"2026-11-12T17:40:36Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":24,"reasons":["conf:2","win:early"],"computed_at":"2026-11-12T20:24:46Z"},"pay":null,"html_url":"https://alion.io/job/third-way-health-information-security-analyst-security-operations-platforms","json_url":"https://alion.io/job/third-way-health-information-security-analyst-security-operations-platforms.json","meta":{"generated_at":"2026-11-12T20:24:46Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":43081,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":685161},"rest":"https://alion.io/mcp/rest/get_company?id=685161"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fthird-way-health-information-security-analyst-security-operations-platforms"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fthird-way-health-information-security-analyst-security-operations-platforms"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fthird-way-health-information-security-analyst-security-operations-platforms"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/third-way-health-information-security-analyst-security-operations-platforms\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fthird-way-health-information-security-analyst-security-operations-platforms"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4182269}},{"tool":"search_jobs","arguments":{"company":"thirdway.health","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4182269},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}