Security Engineer - Vulnerability & Exposure Management

Alivia Health is looking for a Security Engineer focused on Vulnerability & Exposure Management in Guaynabo, PR (onsite). In this role, you will lead improvements to the organization’s vulnerability and exposure management program across servers, endpoints, network, and cloud environments that support ePHI and clinical operations. You will build automation and integrations, coordinate remediation, and translate technical exposure into business and patient-safety risk insights for leadership and governance.

What you’ll own

• Operate and improve the vulnerability and exposure management lifecycle end to end across servers, endpoints, network, and cloud assets, including discovery and scanning, prioritization, remediation, validation, and reporting.
• Define and maintain remediation standards, service levels, and the exception and risk-acceptance process in coordination with the Director of Cybersecurity and Compliance.
• Prioritize risk based on exploitability, asset criticality, data sensitivity, and business context, including performing attack path analysis to identify how exposures chain toward critical systems and data.
• Determine when compensating controls are appropriate instead of full remediation and document residual risk for acceptance by the appropriate owner.
• Design, build, and maintain integrations between security and IT platforms using APIs, connecting vulnerability management, endpoint security, identity, and workflow/ticketing systems to reduce manual handoffs.
• Develop automation across the exposure lifecycle, including asset discovery, finding enrichment, ticket creation and assignment, remediation verification, and closure, with reporting pipelines that sustain metrics rather than relying on periodic manual compilation.
• Explore cloud-native services to host automation and internal tooling, using source control, testing, peer review, and documentation to keep tooling maintainable and reusable across security domains.
• Extend exposure management into Azure, identifying misconfigurations, insecure service configurations, and internet-facing exposure across Azure workloads.
• Assess cloud network and identity configurations from a security perspective, including segmentation, routing, network security groups, ingress and egress paths, private connectivity, file transfer services, managed identities, service principals, and least-privilege role scoping.
• Review business cloud services for secure configuration, advise teams on secure design, and help define cloud security baselines and guardrails with IT and Data Governance.
• Coordinate across IT Operations, Help Desk, Applications, Data Governance, and business and clinical system owners as the primary point of contact for vulnerability and exposure risk, driving patching and secure configuration to closure.
• Advise project teams and solution owners on exposure risk during evaluation of new systems and infrastructure, and collaborate with detection/response and identity functions on threat-informed prioritization and identity-related exposure.
• Develop and present vulnerability and exposure metrics, baselines, and risk reporting to IT leadership, governance committees, and Compliance, translating technical findings into business and patient-safety risk terms.
• Support internal and external audits and accreditation activities, including OCR, CMS, URAC, and NCQA, and maintain program documentation, runbooks, and remediation records aligned with the HIPAA Security Rule, NIST 800-40, and NIST 800-53.
• Ensure compliance with applicable regulatory, legal, and accreditation requirements, and internal policies and procedures, including participation in control documentation, testing, and remediation activities as required.
• Complete mandatory and role-specific training within established deadlines, maintain required certifications, and participate in continuing education to support competence and compliance.

Qualifications

• Bachelor’s degree in Information Technology, Computer Science, or a related field, or minimum of 75 approved credits with equivalent progressive experience.
• Three or more years of combined experience in IT infrastructure, systems administration, or security, including hands-on exposure to vulnerability management or security operations.
• Infrastructure and networking foundation, including server administration, networking and routing, firewalls, and directory services, with ability to reason about how systems are exposed.
• Demonstrated scripting and automation capability with PowerShell or Python, and experience integrating systems through APIs.
• Working knowledge of a major cloud platform, with Azure preferred, including core services, networking, and identity concepts, and ability to extend into cloud security.
• Experience with vulnerability management or endpoint security platforms and remediation workflows; Rapid7 and Microsoft Defender preferred.
• Understanding of risk-based prioritization concepts, including CVSS, EPSS, and known exploited vulnerability sources.
• Ability to coordinate technical work across multiple teams and influence outcomes without direct authority, with strong written and verbal communication and experience presenting technical risk to leadership.
• Healthcare compliance understanding, including HIPAA and HITECH, and application to vulnerability and exposure management.
• Relevant certifications such as CompTIA Security+, Linux+, or Microsoft security certifications are preferred, with willingness to pursue certification expected.

Technology focus

• PowerShell, Python, Azure
• Rapid7, Microsoft Defender
• CVSS, EPSS
• HIPAA, HITECH
• NIST 800-40, NIST 800-53
• CompTIA Security+, Linux+

Growth roadmap

• Independently own the full exposure lifecycle across on-premises, cloud, and external attack surface.
• Build and maintain automation and integrations that materially reduce manual effort and time to remediation.
• Extend cloud security coverage into posture management, entitlement review, and secure architecture advisory.
• Lead validation activities, including penetration test scoping and remediation strategy.
• Set prioritization strategy and influence remediation planning across IT and business functions.
• Mentor peers and establish engineering practices adopted across other security domains.