Listing Description
Everly Health's mission is to transform lives with modern, diagnostics-driven care, and we believe that the future of healthcare is meeting people where they are. Headquartered in Austin, Texas, Everly Health is the parent company to Everlywell, Everly Health Solutions, Natalist, and Everly Diagnostics. We've set a new standard of people-focused, diagnostic-driven care that puts patients at the center of their own health journey.
Our infrastructure guides the full testing experience with the support of a national clinician network that's composed of hundreds of physicians, nurses, genetic counselors, PharmDs, and member care specialists. Our solutions make world-class virtual care more attainable with rigorous clinical protocols and best-in-class science to tackle some of the healthcare industry's biggest problems.
As a member of the security team at Everly Health, you will have the opportunity to shape the security detection, operations and incident response processes. You will research and discover the latest threats on product, cloud infrastructure, workloads, containers and develop methods, queries and dashboards to detect and visualize events of interest. You will develop incident response playbooks to allow quick resolution of identified security events.
You'll work across many teams including infrastructure, engineering, product, compliance, and across multiple streams. We’re looking for someone that has deep technical expertise in threat detection, incident root cause analysis, querying and alerting using SIEM systems, automation, AWS cloud, and experience to join a fast-paced, growing team tackling challenging problems at scale.
What You'll Do:Threat Detection: It's important to detect security incidents before they cause material damage to the business. You will detect attacks and prioritize, analyze and drive alerts to resolution. In the event an alert is identified as a security incident, you will kick off Incident ResponseIncident Response: You will rapidly scope, contain and eradicate threats, minimizing financial, legal, business and content losses. Services include but are not limited to root-cause analysis, memory and disk forensics, reverse engineering, network containment, threat eradication and postmortems. You will also develop and refine processes, plans and procedures and partner closely with Legal, Comms and other stakeholders across the business.Design and carry out security incident preparedness activities, such as compromise assessments and tabletop exercises, and conduct training and awareness sessions for relevant staff.Deploy and support tools to collect and correlate security telemetry. Tooling includes Network Detection and Response, SIEM, Endpoint Detection and Response, Threat Intelligence platforms, and Security Orchestration Automation and Response tools.Drive the adoption of best practices for security through the SDLCBuild automated guardrails to enhance the security of our applicationsWork with our red team to identify potential security vulnerabilitiesEducate the engineering team on defensive codingSupport HITRUST, SOC2 and other security certifications.Work with Privacy and Compliance to document and monitor our security practices.Partner with product engineering teams on secure cloud development practices and build security automation into pipelinesImprove vulnerability management processes and security control maintenanceCollaborate with senior leaders to assess near-term and long-term security needs.
Who You Are:Naturally curious and interested in security and privacyComfortable engaging with departments outside of engineering to heighten securityExperience with vulnerabilities, exploits, and their defensesCan balance articulating the big picture and details depending on the audienceEager and excited to evangelize securityKnowledge of Cybersecurity Frameworks: HITRUST, NIST, ISOCollaborates well with cross functional team members: product, compliance, privacy, and engineering in a fast paced, regularly changing environmentIs most comfortable when there’s too much to do and can juggle a variety of tasksEveryone knows that when you take on a task whether it’s huge and scary or tiny and boring, you’re going to see it through
What You've Done:BS (or equivalent) in Computer Science, Software Engineering, or related field.5+ years of Experience with Cloud security (AWS, Azure, etc.)Experience with secure SDLC best practicesUnderstanding of authentication protocols and frameworks (OAuth, SSO/SAML, OpenID, etc.)DevOps and configuration management with tools like Terraform, Ansible, etc.Conversant with REST and/or GraphQLExperience with Zero-Trust architectures.Experience with configuration of log aggregation SIEM solutions.Juggled a variety of different responsibilitiesInfluenced or inspired cross functional teams to take action around securityAdvanced programming experience (Ruby, Python, Golang, Bash, etc)One of the following or equivalent certifications:Security+ (CompTIA)Network+ (CompTIA)Microsoft Security Compliance and Identity Fundamentals (SC-900)Microsoft Azure Fundamentals (AZ-900)AWS Cloud PractitionerAWS Security SpecialtyCISSPYou'll Love Working Here:
· Venture backed by top-tier firms
· The opportunity ahead knows no bounds
· Open vacation policy for salaried team members
· Front Loaded PTO for hourly team members
· Employee discounts
· Paid parental leave
· Health benefits
· 401(k)
NO EXTERNAL RECRUITERS - INDIVIDUAL APPLICANTS ONLY
Everly Health is committed to providing equal employment opportunities in all employment practices. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, citizenship status, marital status, age, disability, protected veteran status, sexual orientation or any other characteristic protected by law.
HIPAA Disclaimer: This role will be in an environment that has access to protected health information (PHI) and all security standards to protect PHI must be followed.
Listing Details
-
Citizenship:
Not Provided
-
Incentives:
Not Provided
-
Education:
Not Provided
-
Travel:
Not Provided
-
Telework:
Not Provided