[Hiring] Senior IT Security Engineer @R1 RCM

Role Description

The Offensive Security team is hiring a Senior IT Security Engineer to strengthen how we find and fix vulnerabilities before attackers do. You'll run hands-on penetration tests across infrastructure, networks, and applications, work across multiple cloud environments, and help mature testing methodology and tooling for a healthcare technology company operating at real scale. This is an individual contributor role with room to shape process, not just execute against a checklist.

Responsibilities

• Plan and execute penetration tests across internal and external infrastructure, networks, and web and mobile applications.
• Perform application security testing — manual and tool-assisted — integrated into the SDLC, including source-code-assisted ("gray box") testing where applicable.
• Test across multiple cloud environments (AWS, Azure, and/or GCP), including cloud configuration, IAM, and workload-level exposures.
• Simulate real-world adversary techniques against production and pre-production systems, in coordination with engineering and infrastructure owners.
• Build, maintain, and extend a toolkit spanning both open-source and commercial tooling; write custom scripts and tools to close gaps in existing coverage.
• Document findings with clear risk ratings, reproduction steps, and remediation guidance, for both engineering teams and executive stakeholders.
• Partner with engineering, infrastructure, and product teams to validate fixes and reduce time-to-remediation.
• Support testing tied to compliance obligations, including HIPAA, SOC 2, and PCI DSS assessments and audits.
• Track emerging attack techniques, exploits, and threat intelligence relevant to healthcare and revenue cycle technology environments.
• Contribute to tabletop exercises, purple-team collaboration, and internal security training as needed.

Qualifications

• 5+ years of hands-on experience in penetration testing or offensive security, spanning both infrastructure/network and application security testing.
• At least one recognized offensive security certification — e.g., OSCP, GPEN, GWAPT, GXPN, CEH, or equivalent demonstrated hands-on skill — with a track record of pursuing further certification.
• Practical experience testing in multiple cloud environments (AWS, Azure, and/or GCP), not just on-prem infrastructure.
• Working knowledge of established methodologies and frameworks: MITRE ATT&CK, the OWASP Testing Guide, and PTES.
• Fluency with both open-source and commercial security tooling (e.g., Burp Suite, Zap, Nmap, Metasploit, BloodHound, Nuclei, OWASP ZAP) and the judgment to pick the right tool for the job.
• Scripting or automation ability (Python, PowerShell, or Bash) to build custom tooling and speed up repeatable testing.
• Experience operating in environments subject to HIPAA, SOC 2, and/or PCI DSS.
• Strong written and verbal communication — you can explain a finding's real-world impact to an engineer and to a non-technical stakeholder in the same afternoon.
• Comfort operating independently inside a large, fast-paced, matrixed organization.

Requirements

• Advanced certifications: OSWE, OSCE/OSEE, GXPN, CISSP, or CCSP.
• Experience testing containerized environments and Kubernetes.
• API security testing experience (REST/GraphQL), beyond standard web app testing.
• Familiarity with CI/CD pipeline security and secure SDLC integration.
• Experience contributing to or maintaining open-source security tools.
• Healthcare, healthcare IT, or financial services industry experience.
• Experience with AI models, harnesses, and exploiting AI services.

Benefits

• Base pay range is $50,640.00 - $137,481.25 per year.
• Eligible to participate in our annual bonus plan at a target of 10.00%.
• Opportunity to constantly learn, collaborate across groups, and explore new paths for your career.
• Competitive benefits package.