[Hiring] Principal Security Engineer @Aspirion

Role Description

We are looking for a Principal Security Engineer who is a deeply hands-on security engineering leader who serves as the Senior Director of Information Security & Compliance’s right hand for Cloud Security. This role owns end-to-end security architecture and technical execution across our cloud and Microsoft 365 environments—translating risk into actionable engineering requirements, setting guardrails and reference architectures, and driving durable improvements in identity, network, endpoint, and data security. This is a working-leader role: you will design and build controls, automate, and lead technical incident response at depth. While this role may not have direct reports initially, it is expected to lead the cloud security engineering function as it scales by setting technical direction, establishing standards and operating cadence, mentoring engineers/admins, and influencing delivery across IT, DevOps, and application teams.

Duties and Responsibilities

• Act as hands-on technical lead for Cloud Security engineering: personally drive key designs, build and automate controls, review high-risk changes, and raise engineering quality through standards, patterns, and practical guidance.
• Own the Cloud Security engineering roadmap and operating cadence: intake/prioritization, quarterly planning, technical governance (architecture review), KPI/SLO definition, and stakeholder communication with IT, DevOps, and application teams.
• Provide hands-on technical leadership for security engineering initiatives end-to-end—from threat modeling and design reviews through build, rollout, and operationalization—producing clear technical artifacts (diagrams, decision records, runbooks, and patterns) and delegating effectively across the team.
• Build and mature Zero Trust controls: identity governance, Conditional Access strategy, MFA and phishing-resistant authentication, privileged access management, and secure access patterns for administrators and service accounts.
• Establish logging, detection, and response engineering: define telemetry requirements, build detections and automation, and ensure high-fidelity coverage across cloud control plane, workloads, endpoints, and identity.
• Lead technical incident response for cloud and identity events: drive containment/eradication, perform root cause analysis, and implement preventative engineering changes; partner with the SOC/MSSP and set clear technical performance expectations.
• Own cloud vulnerability management and secure configuration: define baselines, prioritize remediation based on exploitability and business impact, and partner with infrastructure/app teams to drive fixes to closure.
• Implement data security and governance controls across Microsoft Purview (classification, labeling, DLP) and encryption/key management (including Key Vault/KMS), aligned to regulatory and contractual requirements.
• Drive endpoint and device security strategy with Microsoft Intune (MDM/MAM), security baselines, and hardening; partner with IAM and IT Ops to reduce identity and endpoint attack surface.
• Own secure SDLC and CI/CD controls for cloud/platform delivery using GitHub: integrate and operationalize Snyk (SCA/SAST as applicable), secrets scanning, and policy-as-code/gating; define remediation SLAs and exception processes; reduce noise through tuning; and drive developer enablement and adoption metrics.
• Own Cloud Security outcomes end-to-end (guardrails, identity, network, workload, logging/detection) and partner with application engineering leaders to embed SDLC controls into product teams—providing patterns, tooling, and governance while enabling teams to ship securely.
• Partner with GRC/Compliance to translate NIST/HIPAA/HITRUST requirements into implementable technical controls; support audits by producing architecture evidence, control narratives, and remediation plans.
• Manage security tooling and service relationships (e.g., MSSP/SOC, SIEM/SOAR, vulnerability scanning): define requirements, evaluate solutions, oversee implementations, and manage renewals and budget in partnership with leadership and procurement.
• Establish the team’s operational model: on-call and escalation paths, incident response roles and rotations, runbooks, post-incident reviews, and continuous improvement of reliability and security outcomes.
• Mentor and level-up engineers and administrators through pairing, reviews, and design critiques; establish hiring rubrics, career ladders, and a high quality bar for security work (tests, change control, documentation, and operational readiness).
• Perform other duties as assigned.

Qualifications

• Principal-level security architecture skills: able to design end-to-end controls across identity, network, compute, data, and monitoring with clear tradeoffs (cost, reliability, usability, and risk).
• Hands-on engineering ability: scripting/automation and deep platform experience (Azure and Microsoft 365 strongly preferred) to build guardrails, detections, and operational tooling.
• Threat modeling and adversary-aware thinking; experience mapping threats to technical mitigations and detection strategies.
• Operational excellence: strong incident command at the technical level, root cause analysis, and bias toward preventative engineering.
• Ability to influence architecture decisions across teams without formal authority; clear written communication (design docs, standards, runbooks) and strong technical judgment.
• Experience designing security telemetry, SIEM/SOAR workflows, and detection engineering practices; ability to evaluate and tune MSSP/SOC outcomes.
• Strong coaching and mentoring skills; raises the technical bar for the organization and develops others through reviews and hands-on collaboration.
• Secure SDLC / AppSec tooling leadership: can implement and run scanning and governance programs (e.g., Snyk + GitHub), balance friction vs. risk, and build strong partnerships with engineering to drive adoption and remediation.
• Strong organizational leadership: can set direction, align stakeholders, and communicate complex technical risk and tradeoffs to executives and non-technical partners.
• Ability to scale a function: experience leading through influence, and (preferred) building/leading teams as scope grows.
• Comfort operating in ambiguity with high ownership, prioritizing ruthlessly, and delivering outcomes.

Education and Experience Qualifications

• 10+ years in security engineering, cloud infrastructure, or related technical roles, including 5+ years owning cloud security architecture and execution in production Azure environments (AWS/GCP experience a plus).
• Demonstrated experience building and/or materially maturing a cloud security program (guardrails, standards, secure landing zones, detection/response, vulnerability management) with measurable outcomes.
• Deep expertise in identity and access management and Zero Trust (Entra ID/Azure AD, Conditional Access, MFA, privileged access, service principals, and least privilege design).
• Strong cloud network and workload security skills (VNets/VPCs, private connectivity, firewall/WAF, segmentation, container/Kubernetes security, and secure secrets management).
• Experience implementing data security controls, including classification/labeling and DLP (Microsoft Purview preferred), encryption, and key management.
• Proven incident response leadership for cloud/identity events, including forensics triage, containment, and post-incident engineering remediation.
• Strong automation and IaC experience (PowerShell/Python; Terraform/Bicep/ARM/CloudFormation) and ability to implement policy-as-code and continuous compliance evidence collection.
• Demonstrated experience implementing secure SDLC controls in GitHub (e.g., GitHub Actions) including integrating Snyk and establishing dependency governance, scanning standards, pipeline gates, and measurable remediation workflows.
• Experience operating in regulated environments (HIPAA required; NIST and HITRUST experience strongly preferred) and translating control frameworks into technical implementations.
• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or related field preferred (or equivalent practical experience).
• People management experience is preferred (hiring, coaching, and performance management), but not required for candidates who demonstrate strong functional leadership and the ability to scale security engineering outcomes through influence.
• One or more certification required: CISSP, CISM, CCSP, GIAC (e.g., GCSA/GCIA/GCIH), AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate (AZ-500) or relevant Expert-level credentials.

Benefits

• Full benefits package, including health, dental, vision, and life insurance upon hire.
• Matching 401k.
• Competitive salaries and advancement opportunities.
• Incentive programs.
• Individual pay is determined by a number of factors including job-related skills, experience, education, training, licensure or certifications obtained, market, location, and organizational factors.
• Must reside in the United States within specified states.

Company Description

Aspirion has delivered market-leading revenue cycle services for over two decades, specializing in collecting challenging payments from third-party payers, focusing on complex denials, aged accounts receivables, motor vehicle accidents, workers’ compensation, Veterans Affairs, and out-of-state Medicaid.

We are committed to creating a results-oriented work environment that is both challenging and rewarding, fostering flexibility, and encouraging personal and professional growth.