Security Operations Engineer

Alaffia Health is a high-growth, venture-backed Series B healthtech startup based in NYC, focused on transforming healthcare operations through innovative technology. The Security Operations Engineer will be responsible for safeguarding the company's cloud-native tech stack and driving automation-first security operations while collaborating closely with engineering and product teams to integrate security into the development lifecycle.

Responsibilities:

• Design and operate SOAR workflows to automate detection, triage, and response across our security tooling
• Build and maintain IaC security policies and code security analysis pipelines integrated into CI/CD
• Automate user provisioning, de-provisioning, and access reviews aligned with RBAC and least-privilege principle
• Implement and automate secrets management and rotation using tools like 1Password Secrets Automation and HashiCorp Vault
• Develop and enforce data loss prevention (DLP) controls and data labeling workflows
• Administer MDM platforms to enforce device compliance, configuration baselines, and security controls
• Manage IAM, PLP, and RBAC across cloud and SaaS environments; conduct regular access review and certifications
• Own the secure onboarding, role-change, and offboarding lifecycle end-to-end
• Lead the full security incident response lifecycle — detection through remediation — leveraging CrowdStrike, Splunk, and ProofPoint
• Conduct proactive threat hunting and maintain threat intelligence pipelines using the MITRE ATT&CK framework
• Manage IDS/IPS monitoring and tune alerting to reduce noise and improve signal fidelity
• Automate vulnerability scanning, tracking, and SLA reporting across infrastructure and applications
• Support and co-own compliance audits for SOC 2 Type II, HIPAA, and HITRUST; contribute to Alaffia’s ISO/IEC 42001:2023 AI governance certification initiative
• Conduct vendor security reviews for new SaaS and AI tool onboarding
• Perform annual IT environment audits and manage audit evidence collection
• Triage and resolve non-hardware IT support tickets via automation
• Collaborate with software engineers to integrate security into the SDLC — including dependency scanning, secrets detection, and container security
• Produce security documentation, runbooks, and knowledge-sharing materials to upskill the broader team

Requirements:

• 5+ years of hands-on security engineering or operations experience in a cloud-native environment
• Proficiency in IAM, RBAC, and privileged access management across cloud and SaaS platforms
• Experience with MDM platforms
• Solid foundation in vulnerability management — scanning, prioritization, and remediation tracking
• Working knowledge of secrets management tools and secure credential lifecycle practices
• Hands-on experience with XDR/EDR and SIEM platforms
• Familiarity with MITRE ATT&CK, threat hunting methodologies, and IDS/IPS operations
• Proven ability to own end-to-end incident response, from triage through post-mortem
• Demonstrated experience building security automations (SOAR, scripting, API integrations)
• Comfortable working with IaC tools and integrating policy-as-code into CI/CD pipelines
• Ability to write scripts or lightweight tooling in Python, Bash, or similar to eliminate manual toil
• Practical understanding of HIPAA, SOC 2, and HITRUST requirements and audit processes
• Awareness of AI governance and risk management frameworks (ISO/IEC 42001:2023, NIST AI RMF) — willingness to grow expertise here is essential
• Ability to communicate risk and security concepts clearly to both technical and non-technical audiences
• Collaborative partner to engineering, product, and clinical teams — not a gatekeeper, but an enabler
• Self-directed and comfortable prioritizing in a fast-moving startup environment
• Bachelor's degree in Computer Science, Information Systems, or equivalent practical experience
• 5+ years of IT/security industry experience; healthcare, cloud, or AI-adjacent environments strongly preferred
• One or more relevant certifications valued: CompTIA Security+, CySA+, or CASP+; ISC2 CISSP; ISACA CISM, CISA, or CCSP; AWS Security Specialty or Microsoft AZ-500
• Direct experience with CrowdStrike Falcon, Splunk SIEM, or ProofPoint email security
• Experience with Addigy (macOS MDM) and/or Microsoft Intune for cross-platform device management
• Familiarity with 1Password for Teams/Secrets Automation or HashiCorp Vault
• Background in or exposure to healthcare industry security requirements beyond HIPAA(e.g., HITRUST r2 audit participation)
• Experience contributing to or preparing for ISO/IEC 42001:2023 or NIST AI RMF implementations
• Comfortable working in software development environments using TypeScript, Python, or Go; Docker/Kubernetes; GitHub; Datadog
• Experience with developer security tooling: SAST, DAST, dependency scanning, or secrets detection in CI/CD
• Prior involvement in building or maturing a security program at a startup or high-growth company