Security Engineer - Vulnerability & Exposure Management

Alivia Health is seeking a Security Engineer focused on Vulnerability and Exposure Management. In this onsite role in Guaynabo, PR, you will own and continuously improve the organization’s vulnerability and exposure management program across servers, endpoints, network, and cloud environments supporting ePHI and clinical operations.

Key Responsibilities

• Own the vulnerability and exposure management lifecycle end to end across servers, endpoints, network, and cloud assets supporting ePHI and clinical operations, from discovery and scanning through prioritization, remediation, validation, and reporting.
• Define and maintain remediation standards, service levels, and the exception and risk-acceptance process in coordination with the Director of Cybersecurity and Compliance.
• Perform risk-based prioritization using exploitability, asset criticality, data sensitivity, and business context; conduct attack path analysis to identify how exposures chain into routes toward critical systems and data.
• Determine when compensating controls are appropriate in place of full remediation and document residual risk for acceptance by the appropriate owner.
• Design, build, and maintain integrations between security and IT platforms using APIs, connecting vulnerability management, endpoint security, identity, and workflow and ticketing systems so data and actions flow without manual handoff.
• Develop automation across the exposure lifecycle, including asset discovery, finding enrichment, ticket creation and assignment, remediation verification, and closure, and build reporting pipelines that produce metrics on a sustained basis rather than through periodic manual compilation.
• Explore cloud-native services to host automation and internal tooling, applying source control, testing, peer review, and documentation to keep tooling maintainable; establish reusable engineering patterns that can be adopted across other security domains.
• Extend exposure management into the organization’s cloud environment by identifying misconfigurations, insecure service configuration, and internet-facing exposure across Azure workloads.
• Assess cloud network and identity configuration from a security perspective, including segmentation, routing, network security groups, ingress and egress paths, private connectivity, file transfer services, managed identities, service principals, and least-privilege role scoping.
• Review cloud services adopted by the business for secure configuration, advise project teams on secure design, and contribute to the definition of a cloud security baseline and guardrails in partnership with IT and Data Governance.
• Act as the primary point of contact for vulnerability and exposure risk across the organization, coordinating with IT Operations, Help Desk, Applications, Data Governance, and business and clinical system owners to drive patching and secure configuration to closure.
• Advise project teams and solution owners on exposure risk during evaluation of new systems and infrastructure; collaborate with detection and response and identity functions on threat-informed prioritization and identity-related exposure.
• Develop and present vulnerability and exposure metrics, baselines, and risk reporting to IT leadership, governance committees, and Compliance, translating technical findings into business and patient-safety risk terms.
• Support internal and external audits and accreditation activities, including OCR, CMS, URAC, and NCQA, and maintain program documentation, runbooks, and remediation records aligned with the HIPAA Security Rule, NIST 800-40, and NIST 800-53.
• Ensure compliance with applicable regulatory, legal, and accreditation requirements, as well as internal policies and procedures; participate in internal control documentation, testing, and remediation activities as required; maintain ongoing awareness of compliance obligations and support audit processes.
• Complete mandatory and role-specific training requirements within established deadlines, maintain required certifications, and participate in continuing education to support competence and compliance with industry best practices.

Required Qualifications

• Bachelor’s degree in Information Technology, Computer Science, or a related field, or a minimum of 75 approved credits with equivalent progressive experience in the field.
• Three or more years of combined experience in IT infrastructure, systems administration, or security, including hands-on exposure to vulnerability management or security operations.
• Infrastructure and networking foundation, including server administration, networking and routing, firewalls, and directory services, with the ability to reason about system exposure.
• Demonstrated scripting and automation capability with PowerShell or Python, and experience integrating systems through APIs.
• Working knowledge of a major cloud platform, Azure preferred, including core services, networking, and identity concepts, with the ability to extend that knowledge into cloud security.
• Experience with vulnerability management or endpoint security platforms and remediation workflows, with Rapid7 and Microsoft Defender preferred.
• Understanding of risk-based prioritization concepts, including CVSS, EPSS, and known exploited vulnerability sources.
• Demonstrated ability to coordinate technical work across multiple teams and influence outcomes without direct authority, with strong written and verbal communication including presenting technical risk to leadership.
• Understanding of healthcare compliance requirements, including HIPAA and HITECH, and their application to vulnerability and exposure management.
• Relevant industry certifications such as CompTIA Security+, Linux+, or Microsoft security certifications are preferred; willingness to pursue certification is expected.

Technologies

• PowerShell, Python
• Azure
• Rapid7
• Microsoft Defender
• CVSS, EPSS
• HIPAA, HITECH
• NIST 800-40, NIST 800-53
• CompTIA Security+, Linux+

Growth Roadmap

• Independently own the full exposure lifecycle across on-premises, cloud, and external attack surface.
• Build and maintain automation and integrations that materially reduce manual effort and time to remediation.
• Extend cloud security coverage into posture management, entitlement review, and secure architecture advisory.
• Lead validation activities, including penetration test scoping and remediation strategy.
• Set prioritization strategy and influence remediation planning across IT and business functions.
• Mentor peers and establish engineering practices adopted across other security domains.