[Hiring] Platform Software Engineer @OneOncology

Role Description

Reporting to the Manager, Software & AI Engineering, the Platform Software Engineer builds, operates, and enhances the Microsoft Azure foundation that supports OneOncology’s engineering teams and applications. This role is also responsible for the technical controls that support OneOncology’s HITRUST CSF certification, with a focus on automating infrastructure, strengthening a HIPAA-regulated environment, and creating continuous, efficient processes for compliance evidence collection.

This is a hands-on role with a high degree of autonomy on a small engineering team. The Platform Software Engineer will contribute to both technical design and implementation and will take ownership of solutions from end to end—from developing and maintaining Terraform modules to supporting technical controls, compliance requirements, and audit responses.

This is a full-time remote position within the United States. Employees located in the Nashville, TN area have the option to work from the Nashville office.

Responsibilities

• Design, provision, and operate Azure infrastructure—including App Service, AKS, Functions, networking, storage, and databases—using Terraform or Bicep with disciplined module design, state management, and peer review.
• Build and maintain CI/CD pipelines in Azure DevOps for secure, repeatable infrastructure and application deployments with appropriate change management.
• Automate routine operational tasks and workflows using PowerShell, Bash, or Python.
• Own the platform and infrastructure controls that support OneOncology’s HITRUST CSF certification, partnering with Security and Compliance on scoping, readiness, remediation, and assessment.
• Build and maintain secure configuration baselines, reusable infrastructure modules, and automated control monitoring and evidence collection using tools such as Azure Policy and Microsoft Defender for Cloud.
• Extend controls and tooling to newly acquired practices and environments as OneOncology grows.
• Administer identity and access controls through Microsoft Entra ID, RBAC, Privileged Identity Management, Conditional Access, and MFA, including access reviews and enforcement of least-privilege and segregation-of-duties principles.
• Manage secrets, certificates, and encryption keys in Azure Key Vault, including rotation and lifecycle management.
• Maintain centralized logging, monitoring, detections, alerts, and dashboards using Azure Monitor, Log Analytics, and Microsoft Sentinel, with appropriate audit retention and immutability requirements. Participate in incident response and the on-call rotation.
• Run authenticated vulnerability scanning and drive risk-based remediation within agreed SLAs.
• Manage patching across cloud and server workloads with minimal disruption.
• Maintain backup and disaster recovery capabilities and test recovery against defined RTO and RPO targets.
• Develop self-service tooling, templates, runbooks, and documentation that enable application engineers to move quickly within established security and compliance guardrails.
• Additional responsibilities as assigned to help drive our mission of improving the lives of everyone living with cancer.

Qualifications

• Required: Bachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent work experience.
• High school diploma or GED.
• 5+ years of experience in platform, infrastructure, DevOps, cloud, or site reliability engineering.
• 3+ years of hands-on Microsoft Azure experience across compute, networking, identity, storage, and monitoring.
• Demonstrated experience with Infrastructure as Code (Terraform, Bicep, or ARM templates), including module design and state management.
• Experience designing and maintaining CI/CD pipelines, ideally in Azure DevOps or GitHub Actions.
• Strong scripting skills in PowerShell, Bash, or Python.
• Working knowledge of at least one healthcare or security compliance framework — HITRUST CSF, HIPAA/HITECH, SOC 2, or NIST — and practical experience enforcing those controls in a cloud environment.
• Comfort operating autonomously on a small team and owning problems end to end.
• Preferred: Direct experience supporting a HITRUST CSF validated assessment (e1, i1, or r2) or an equivalent audit, including evidence preparation.
• Experience in healthcare technology or another HIPAA-regulated environment.
• Kubernetes / AKS and container security experience.
• SIEM experience (Microsoft Sentinel) and familiarity with compliance automation tooling such as MyCSF, Vanta, or Drata.
• Certifications such as AZ-104, AZ-400, AZ-500, CKA/CKS, CISSP, or HITRUST CCSFP.
• Familiarity with AI-assisted engineering tools and how to adopt them safely in a regulated environment.

Essential Competencies

• Autonomy and ownership — able to take an ambiguous problem from design through production with limited oversight.
• Architectural judgment — designs systems, not just features, and can explain the tradeoffs behind a decision.
• Clear written and verbal communication with both technical and non-technical partners.
• Generalist range and comfort operating on a small, fast-moving engineering team.
• Sound handling of protected health information and a security-first mindset.
• Attendance is an essential job function.