Cybersecurity Engineer

About DrFirst For 25 years, DrFirst has empowered providers and patients to achieve better health through intelligent medication management. We improve healthcare workflows and help patients start and stay on therapy with end-to-end solutions that enhance prescription access, affordability, and adherence. Our solutions help 100 million patients a year and are used by more than 420,000 prescribers, 71,000 pharmacies, 270 EHRs and health information systems, and over 2,000 hospitals in the U.S. This is a great opportunity to be a part of a successful Healthcare IT company experiencing significant growth. Here you'll get to work with some of the smartest and most interesting people around; solving unique and complex challenges in healthcare on a scale matched by a few companies. If you get excited about stretching yourself in new ways, developing yourself to your fullest potential, care about working with smart colleagues; we want to talk to you!Position OverviewAt DrFirst, we play in the major leagues. Our 5-person security team covers what most organizations staff with ten or more — not by working longer, but by working smarter. We are adding a Cybersecurity Engineer to grow that team, and we are looking for someone who earns their place as an engineer — not an analyst.The difference matters. Analysts follow playbooks. Engineers understand the systems well enough to know when something is wrong — and to build the automation that catches it faster next time. You will triage alerts, complete security risk assessments, contribute to DevSecOps, and collect audit evidence. But you will do all of it with enough platform depth that you can spot a misconfiguration during evidence collection, not just screenshot and move on.More importantly, you use AI the way an engineer uses any powerful tool — to rethink how work gets done, not just to finish it faster. You do not just prompt Claude to complete a task. You ask whether the task should exist in its current form at all, and if not, you build something that eliminates it. You have done this already. Others would describe you this way — keep reading.What You ContributeYou report to the VP Security and work alongside two Principal Security Engineers and one Senior Cybersecurity Engineer. You own your queue and contribute to shared goals. You are not handed a checklist — you are expected to understand what you are looking at.DomainScopeCadenceSecurity OperationsAlert triage across SentinelOne, Proofpoint, Splunk, AWS Security Hub, GCP SCC, Tenable, Zscaler. Security inbox, customer questionnaires, SRAs, KnowBe4, onboarding/offboarding compliance, endpoint and allowlist controls.Steady stateDevSecOps — ContributorContribute alongside a Principal who spends 60% of his time here. Pipeline security, secure SDLC, security tooling integration. Tangible deliverables.OngoingSecurity Incident ResponseIncident response, proactive threat prevention, security reviews for new product features.As neededAudit Evidence CollectionSOC 2 / HITRUST evidence for your domains. Platform depth matters — you flag misconfigurations, not just collect screenshots.Seasonal burstWhat you will work onStrategic Initiatives You Step Into From Day OneActive initiatives with momentum. You contribute immediately.InitiativeWhat You Step IntoAudit Evidence AutomationActive initiative to automate SOC 2 / HITRUST evidence collection using Claude Code — moving the team from collectors to SME reviewers. You contribute to this from day one.Data Governance AutomationRetention policy framework in progress. Drive AI-assisted implementation by data stream and category, coordinate purge processes across email and corporate data stores.Corporate Claude EnvironmentContribute to security architecture, guardrails, and governance for non-engineering staff using Claude for automation and data access via MCPs.How We WorkSecurity is one of the fastest-moving domains in tech — AI is expanding the attack surface, automating threats, and simultaneously giving defenders more leverage than ever. We are not treading water here. We are building an AI-driven security function and looking for someone who wants to help shape what that looks like — not be handed a blueprint.Think You Can Do This? Here Is What Day 30 Looks Like.This is the kind of place where you can actually get things done — not just talk about doing them. By the end of your first 30 days:✓Security inbox is running clean — SRAs and customer questionnaires completed on time, using existing automation with your own SME judgment applied to the output✓Alert triage cadence established — queue owned, first tuning improvements documented✓At least one AI automation shipped — not planned, not in progress — live, with measurable time savings. Data governance is one area that needs attention.✓An informed point of view on at least one configuration or gap in our stack — something you observed, not something you were told✓At least one tangible DevSecOps deliverable contributed alon