Staff Security Engineer

OpenLoop provides telehealth support solutions and infrastructure for virtual care delivery. The Staff Security Engineer will own and mature endpoint and email security across the organization, engineering controls, standards, baselines, and audit evidence while partnering with Security Operations, IT, Engineering, Compliance, and other teams.

Responsibilities:

• Own the engineering of security controls for our macOS and Windows fleet, including device management (MDM), disk encryption, patch compliance, and local admin controls
• Engineer MDM and mobile application management (MAM) policies that protect company and PHI data on both managed devices and BYOD, including app protection, conditional access, and selective wipe
• Deploy and manage an enterprise browser to secure SaaS and web access, including data controls (copy/paste, download, print), session policies, and extension management
• Build, apply, and continuously measure CIS Benchmark baselines across the fleet. Track drift, manage documented exceptions, and produce fleet-level evidence that holds up to HITRUST and SOC 2 auditors
• Drive application control and least-privilege on endpoints without breaking the clinicians and operators who depend on them
• Own email security for our Google Workspace environment: SPF, DKIM, DMARC enforcement, phishing and BEC defenses, attachment and link protection, and data loss prevention for PHI
• Tune controls to reduce real risk and false positives, and partner with SecOps on phishing triage workflows
• Write security standards, configuration baselines, and runbooks that others can follow without you in the room
• Implement and validate controls identified through threat modeling and security reviews
• Contribute to audit readiness by mapping controls to HITRUST and SOC 2 requirements and owning evidence for your domains
• Automate repetitive work. If you’ve done it twice by hand, script it
• Mentor engineers on SAE and adjacent teams, and serve as an escalation point during incidents in your domains
• Partner with IT, Engineering, Compliance, and SecOps, translating security risk into business and operational terms
• Other duties as assigned

Requirements:

• 8+ years in security engineering, with a track record of owning outcomes end to end
• Deep, hands-on expertise in endpoint security and email security
• Experience deploying and operating MDM/MAM platforms (Kandji, Jamf, Intune, or similar) and email security platforms
• Experience deploying and managing an enterprise browser platform
• Hands-on experience implementing CIS Benchmarks and measuring compliance against them at fleet scale
• Exposure to network security: secure remote access (ZTNA/VPN), DNS filtering, segmentation, or firewall policy
• Working knowledge of cloud security fundamentals (AWS preferred): IAM, network controls, logging, and how workforce access reaches cloud environments
• Exposure to DevSecOps practices: infrastructure as code, CI/CD security, secrets management, or security tooling in pipelines
• Scripting ability in Python, Bash, PowerShell, or similar
• Experience working in a regulated environment (HIPAA, HITRUST, SOC 2, PCI, or similar) and producing audit evidence
• Clear written communication. You can write a standard, defend a decision, and explain a risk to a non-security executive
• Healthcare or health tech experience, especially environments handling PHI
• Experience with Okta or another enterprise identity provider
• Experience supporting a multi-entity organization with subsidiaries or acquisitions
• Relevant certifications (GIAC, CISSP, OSCP, or cloud security certs)