Cybersecurity Specialist

Overview

1JOB TITLE: CYBERSECURITY SPECIALIST

COMPANY OVERVIEW

Therapy Management Corporation (TMC) strives to be the preferred therapy provider andemployer in all communities we serve. We make a positive difference by deliveringcompassionate, superior care to all. Our passionate commitment to service excellence createsloyal customers and cultivates the best working environment for our TMC family. Our success isbuilt on unwavering integrity, ethics, and an environment of innovation.

DESCRIPTION

The Cybersecurity Specialist is responsible for helping protect TMC's systems, applications, cloudinfrastructure, and sensitive data from security threats and vulnerabilities. This role combineshands-on security operations, cloud security, vulnerability management, and compliancemonitoring with a focus on continuously improving TMC's overall security posture.As a Cybersecurity Specialist, you are expected to support the organization and its technologythrough the security lifecycle:➢ Understand the environment: Build a thorough understanding of TMC's applications,infrastructure, users, security controls, regulatory requirements, and evolving threatlandscape.➢ Protect the environment: Implement, maintain, and improve security controls acrossTMC's Azure environment, applications, identities, endpoints, and supporting technologyplatforms.➢ Monitor and respond: Continuously monitor security systems and findings, investigatepotential threats and vulnerabilities, coordinate remediation, and assist with incidentresponse.➢ Maintain compliance: Ensure security controls remain effective and audit-ready bymaintaining security and compliance platforms, evidence, documentation, policies, andremediation activities.

RESPONSIBILITIES

• Own the day-to-day administration, configuration, integration health, and continuousimprovement of TMC's security platforms, with particular responsibility for Vanta andAikido Security.2• Manage Vanta control monitoring, automated tests, evidence collection, access reviews,security findings, and audit-readiness activities.• Manage Aikido Security capabilities including application security scanning, dependencyanalysis, secrets detection, infrastructure-as-code scanning, container security, and cloudsecurity posture monitoring.• Monitor and improve TMC's Microsoft Azure security posture, including identity and accesscontrols, resource configuration, logging, network protections, and cloud security controls.• Configure and maintain applicable Microsoft security technologies such as MicrosoftDefender for Cloud, Microsoft Entra ID, Azure Key Vault, Azure Policy, Azure Monitor, andMicrosoft Sentinel.• Review security findings and vulnerabilities, assess their severity and business risk,prioritize remediation, and verify resolution.• Coordinate security remediation with development, DevSecOps, infrastructure, and othertechnology teams.• Review identity and access controls to support least-privilege access, appropriateauthentication controls, privileged-access management, and secure application identities.• Monitor security alerts and events, investigate suspicious activity, escalate significantthreats, and participate in incident containment, remediation, root-cause analysis, andpost-incident improvement.• Support TMC's compliance with applicable security and healthcare standards, includingHIPAA, SOC 2, and HITRUST, by monitoring control effectiveness, identifying gaps, andcoordinating corrective actions.• Support internal and external audits by maintaining security evidence, responding tofindings, and ensuring corrective actions are tracked to completion.• Assist with third-party security reviews, vendor risk assessments, security questionnaires,and other security-assurance activities as needed.• Develop and maintain security dashboards, reports, procedures, runbooks, and technicaldocumentation.• Automate repetitive security monitoring, reporting, evidence collection, and remediationactivities where appropriate using scripting, APIs, and platform integrations.• Collaborate with development, DevSecOps, infrastructure, compliance, and businessstakeholders to implement practical security improvements while minimizing unnecessaryoperational friction.3• Evaluate existing security controls and recommend improvements to technologies,configurations, processes, and security practices.• Stay current with cybersecurity threats, vulnerabilities, Azure security capabilities,regulatory requirements, and industry best practices.

 

REQUIRED QUALIFICATIONS

 

• Bachelor's degree or higher in Cybersecurity, Information Technology, Computer Science,Information Systems, or a related field, or equivalent work experience.• 3+ years of hands-on experience in cybersecurity, security operations, cloud security,information security, or a related technical security role.• Hands-on experience securing and monitoring Microsoft Azure environments.• Working knowledge of Microsoft cloud security technologies and concepts includingMicrosoft Entra ID, Defender for Cloud, RBAC, Multi-Factor Authentication, ConditionalAccess, Key Vault, Azure networking, logging, and monitoring.• Experience administering or supporting security compliance or GRC automation platformssuch as Vanta, or similar platforms. Direct Vanta experience is strongly preferred.• Experience administering or supporting application and vulnerability security platformssuch as Aikido Security, Snyk, GitHub Advanced Security, or comparable tools. Direct Aikidoexperience is strongly preferred.• Practical experience with vulnerability management, including risk assessment,prioritization, remediation coordination, and validation.• Understanding of application and cloud security concepts including SAST, SCA, secretsdetection, dependency vulnerabilities, infrastructure-as-code security, container security,and cloud misconfiguration.• Working knowledge of identity and access management, least-privilege principles, zerotrustconcepts, and privileged-access management.• Experience investigating security alerts and participating in cybersecurity incidentresponse.• Understanding of security and compliance frameworks applicable to regulatedorganizations, including HIPAA, SOC 2, HITRUST, ISO 42007, NIST, and CIS guidance.• Understanding of networking fundamentals including firewalls, DNS, TCP/IP, VPNs, virtualnetworks, network security groups, and private endpoints.• Familiarity with SIEM technologies, security logging, threat detection, and log analysis.4• Ability to use scripting or automation technologies such as PowerShell, Bash, Python, APIs,or Microsoft Graph to improve security operations.• Strong analytical, troubleshooting, documentation, and communication skills.• Ability to effectively collaborate across development, DevSecOps, infrastructure,compliance, leadership, and business teams.• Demonstrated ability to take ownership, work independently, and continuously improvesecurity processes.• Relevant security certifications such as CompTIA Security+, Microsoft AZ-500, SC-200, SC-300, CISSP, or CCSP are preferred.• Organized, detail-oriented, and process- and improvement-minded

CULTURE FIT

The culture at TMC embraces those that demonstrate a deep passion for solving the problems ofhealthcare with enthusiasm for building positive working relationships and winning as a team.Creating a strong workplace culture has been one of our staples, which we believe encourages andinspires employees to do their best. We also embrace an “All In” mindset and give back to ourcommunities through personal and company initiatives. Individuals in this role should embrace amindset of continuous improvement and be prepared to have some fun along the way!