Senior IT/Security Engineer

USDM Life Sciences is seeking a Senior IT/Security Engineer to lead end-to-end delivery of IT, information security, and GxP computerized-systems initiatives in a regulated environment. Based in Palo Alto, CA, the role covers planning and execution across identity, endpoints, cloud and SaaS security, security operations support, and the documentation required for validation.

You will manage multiple concurrent projects, coordinate internal stakeholders and external partners, and produce reusable technical and validation artifacts. The position also includes incident and vulnerability response support, plus collaboration with Quality to support change control and inspection readiness.

Key Responsibilities

• Run multiple concurrent IT and security projects end-to-end, including defining scope and success criteria, building the plan, tracking dependencies and risks, and driving on-time completion with the Associate Director.
• Maintain a transparent project portfolio in Jira/Confluence with owners, dates, and status; publish concise weekly status updates and escalate blockers early with recommended options.
• Coordinate vendors, MSP/MSSP partners, and consultants; track deliverables against statements of work and hold partners accountable.
• Create clean, reusable project artifacts including requirements, designs, test evidence, runbooks, and handoff documentation.
• Implement and configure identity and access controls using Okta or Microsoft Entra ID for SSO/MFA rollouts, SCIM provisioning, conditional access policies, and access-review cycles.
• Deploy and manage endpoint management and security for macOS and Windows, including MDM enrollment, EDR (for example CrowdStrike and Microsoft Defender), hardening baselines, and patch/vulnerability remediation.
• Execute cloud and SaaS workstreams across Microsoft 365, Azure/AWS, and Google Workspace, including security configuration, DLP and information protection, backup, and integrations.
• Support network and site infrastructure projects including LAN/WLAN, firewalls, and VPN/ZTNA for Palo Alto, Switzerland, and future campuses.
• Automate repetitive tasks using scripting and APIs (for example PowerShell and Python) and document built solutions.
• Triage and investigate security alerts from SIEM/EDR, perform incident response procedures, document findings, and coordinate with the MSSP as directed.
• Run the vulnerability remediation cycle by tracking findings, driving owners to closure, and reporting progress.
• Complete vendor security assessments and customer or partner security questionnaires.
• Perform GxP validation activities for cloud and SaaS systems using risk-based principles (GAMP 5 / CSA) in compliance with 21 CFR Part 11 and EU Annex 11.
• Author and maintain validation lifecycle documentation including Validation Plans and Validation Summary Reports, URS and Functional/Configuration Specifications, Risk Assessments and Traceability Matrices, and IQ/OQ/PQ (or equivalent) protocols and test evidence.
• Support change control, periodic reviews, audit-trail reviews, and inspection readiness in partnership with Quality.
• Communicate proactively with stakeholders across Quality, R&D, Clinical, Finance, and HR, translating technical details for non-technical audiences.
• Present project status and results to leadership, including executive and C-level audiences.
• Provide escalated Tier 3 support and mentor IT support staff and contractors.
• Perform other related duties and assignments as required.

Requirements

• 7+ years of hands-on IT infrastructure and/or information security engineering experience, with a track record delivering multiple projects concurrently and on time.
• Hands-on experience in at least two of the following: identity (Okta/Entra ID), endpoint management/EDR, Microsoft 365/Azure or AWS administration and security, network security, SIEM/alert triage.
• Working knowledge of IAM concepts including SSO, MFA, SAML/OIDC, SCIM, and conditional access.
• Scripting skills in PowerShell, Python, or similar for automation and integration.
• Computerized System Validation experience in a GxP-regulated biotech, pharmaceutical, or medical device environment, including 21 CFR Part 11, EU Annex 11, and GAMP 5.
• Strong project management fundamentals covering planning, task tracking, vendor coordination, risk/issue management, and structured status reporting (Jira/Confluence or equivalent).
• Excellent written and verbal English communication, comfortable presenting to executive and C-level leadership.
• Organized, detail-oriented, and comfortable with ambiguity, with strong follow-through.
• Ability to work on-site in Palo Alto, CA, 40 hours per week, with occasional after-hours availability for maintenance windows and incidents.

Education

Bachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent practical experience.

Technologies

• Okta, Microsoft Entra ID, SSO, MFA, SCIM, conditional access
• macOS, Windows, MDM, EDR (CrowdStrike, Microsoft Defender)
• Microsoft 365, Azure, AWS, Google Workspace, DLP
• VPN, ZTNA, PowerShell, Python, SIEM
• Jira, Confluence, GAMP 5, CSA, 21 CFR Part 11, EU Annex 11, IQ/OQ/PQ
• SAML/OIDC, NIST CSF, SOC 2, CIS Controls, Zscaler, Cloudflare
• DocuSign, Veeva, e-signature

Compensation

USD 70 - 80 per hour (hourly).

Benefits

• Full-time employees may be eligible for health, vision, and dental insurance, life insurance, short and long-term disability, hospital indemnity, accident, and critical care coverage.
• Full and part-time employees age 21 and over are eligible to participate in USDM’s 401k plan.
• Full and part-time employees may be eligible for paid time off.
• All employees are eligible for USDM’s rewards and recognition program.

Preferred Qualifications

• Experience at a clinical-stage or emerging biotech with a lean IT team.
• Certifications including CompTIA Security+, CISSP, Microsoft SC-300/AZ-104, Okta Certified Professional, PMP/CAPM, or ISPE GAMP training.
• Familiarity with security frameworks (NIST CSF, SOC 2, CIS Controls) and SASE/ZTNA platforms (Zscaler, Cloudflare).
• Experience with DocuSign, Veeva, or other common GxP SaaS platforms and with e-signature/Part 11 configurations.

Working Conditions

• Prolonged periods of sitting or standing at a desk and working on a computer in an environmentally controlled home office environment.
• Ability to operate office productivity machinery such as a calculator, scanner, or printer.
• Frequent communication with stakeholders via telephone, email, or instant message, with the ability to exchange accurate information.