Senior Security Analyst - Fuze Health

Fuze Health is a healthcare technology company focused on digitally connecting patients, care providers, employers, health plans, and life sciences companies with care, diagnostics, pharmacy, and related resources. The Senior Security Analyst will lead application security testing, static scanning, remediation, security architecture reviews, WAF monitoring, documentation, automation, and security training across the organization.

Responsibilities:

• Report to the Director of Security Engineering as a key member of the Information Security Team
• Ensure comprehensive security testing on all company applications by utilizing vendors to conduct tests, and conducting their own security testing
• Manage testing scheduling and portfolio of multiple company entities
• Work with teams to perform security testing (including pentesting and architecture reviews) before applications go-live
• Lead Static Scanning (SAST) service and triage results to advise development teams on remediation areas
• Write documentation including policies and procedures
• Identify opportunities for improvement / automation
• Communicate and train our Security Champions as part of effort to shift left
• Work with development teams to remediate and retest items until closure
• Tracking applications to ensure they have the required level of testing depth and cadence
• Maintain and monitor Web Application Firewall (WAF) events and alerts
• Participate in the on-call roster, including hours outside of normal business
• As a security analyst, you’ll be working with team members across the Fuze Health environment in order to ensure that applications are tested and secured - with reviews prior to go-live

Requirements:

• • You'll need a good understanding of computing / networking / cloud computing
• • Problem solving, curiosity, and willingness to learn are key traits
• • Be able to demonstrate a working knowledge of the above areas
• • Comfortable working in a fast-paced environment with excellent communication skills
• • Providing security recommendations on design and application development and coding
• • Strong technical skills in Linux and Windows operating systems, scripting languages like Python. Experience with application and infrastructure security as code
• • You should have ingenuity and strong problem-solving skills in order to swiftly and creatively deal with threats or flaws in networks
• • Candidates should be familiar with agile development processes and have experience integrating secure development practices into agile projects
• • Familiarity with industry standards and regulations including CIS, OWASP, HITRUST, ISO
• • BS degree in Computer Science or related field
• • Travel within the US may be required on an irregular basis (minimal travel)
• • At least 4 years' relevant experience in the cybersecurity industry
• Physical requirements for this role include the ability to work at a computer terminal with monitor, keyboard and mouse for extended periods of time, stoop, bend, and reach for equipment and supplies, make frequent repetitive motions required to operate a computer that include the wrists, hands and fingers, and lift, carry, push, pull, and move light objects up to 20 pounds. The role also requires the ability to effectively communicate through verbal interactions, discern auditory information, and visually perceive details to perform essential job functions
• • Fuze Health is limited to individuals residing in the following states: Alabama, Arizona, Arkansas, California, Colorado, Connecticut, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Vermont, Virginia, Washington (WA), Wisconsin
• Applicants must be authorized to work for any employer in the U.S
• • AWS certification at Associate and / or Speciality level preferred
• • Certifications such as OSCP, GWAPT, or GPEN preferred