Staff Security Engineer

Lyric is an AI-first, platform-based healthcare technology company focused on simplifying the business of care. The Staff Security Engineer will design, implement, and operate security technologies to protect Lyric’s intellectual property and customer data across various cloud ecosystems and corporate infrastructure.

Responsibilities:

• Design, build, deploy, and operate security controls and tooling across AWS, Azure, corporate networks, and endpoints
• Engineer, tune, and maintain SIEM content – log onboarding, parsing, correlation rules, and detections – and develop automation and orchestration (SOAR) playbooks to reduce response times
• Administer and optimize the endpoint detection and response (EDR) platform, including sensor deployment, policy tuning, threat hunting support, and endpoint hardening
• Engineer and maintain identity and access management capabilities, including single sign-on (SSO), multi-factor authentication (MFA), conditional access, privileged identity/access management (PIM/PAM), and role lifecycle automation
• Partner with Security Architecture to translate reference architectures and design principles into implemented, measurable technical controls, providing feedback that improves future designs
• Serve as a technical lead during security incidents – building and maintaining containment tooling, forensics readiness, and response runbooks, and participating in post-incident reviews
• Operate the vulnerability management lifecycle: scanning, risk-based prioritization, and partnering with application and infrastructure teams to drive remediation to closure
• Implement and enforce baseline security configuration standards (e.g., CIS benchmarks, OS hardening, network segmentation, web application firewall) through infrastructure-as-code and policy-as-code where possible
• Evaluate, proof-of-concept, and recommend security technologies, tools, and services to the broader security team based on security policy, threat drivers, and operational fit
• Mentor junior engineers, maintain high-quality documentation and runbooks, and participate in an on-call rotation for security escalations

Requirements:

• Minimum of seven (7) years of experience in hands-on security engineering and/or security operations
• Minimum of three (3) years of experience engineering and operating security controls within Amazon Web Services (AWS) and Microsoft (MS) Azure
• Bachelor's degree in Computer Science, Information Systems, or equivalent practical experience
• CISSP, CCSP, GIAC (e.g., GSEC, GCIH, GCIA), or other relevant security-related designation(s)
• AWS Security Specialty Certification, Azure Security Engineer Certification
• Experience engineering identity platforms such as Microsoft Entra ID, including conditional access, privileged identity management (PIM), and identity governance
• Experience administering endpoint detection and response (EDR) platforms (e.g., CrowdStrike Falcon) and engineering SIEM detections, including detection-as-code practices
• Proficiency with scripting and automation – Python, PowerShell, and infrastructure-as-code tooling such as Terraform – to deliver security capabilities at scale
• Experience in DevSecOps, container and Kubernetes security, CI/CD pipeline security, and securing SaaS, IaaS, and PaaS workloads
• Experience with network security technologies, including WAF/CDN/DDoS services, intrusion detection/prevention systems (IDS/IPS), network segmentation, and zero trust access patterns
• Working knowledge of security frameworks and standards such as the NIST Cybersecurity Framework, HITRUST, CIS benchmarks, and the MITRE ATT&CK framework
• Experience with data protection, including data loss prevention (DLP), cryptography, key management, and public key infrastructure (PKI)
• Experience operating security tooling in healthcare or other regulated environments subject to HIPAA or similar data protection requirements