> Markdown version of [/jobs/ext/3767593-us-it-security-eng-sr](https://www.wearedevelopers.com/jobs/ext/3767593-us-it-security-eng-sr). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # US-IT Security Eng Sr - **Company:** R1 RCM Inc. - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $50,640.0 - $137,481.0 - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Software System Penetration Testing, Microsoft Azure, Bash Shell, Health Informatics, Burp Suite, Cyber Security, Continuous Integration, Identity and Access Management, Mobile Application Software, Python (Programming Language), Machine Learning, Nmap, Open Source Technology, Open Web Application Security, PCI Data Security Standards, Windows PowerShell, Systems Development Life Cycle, Web Applications, Scripting, Cloud Platform System, Software Security, Mitre Att&ck, GWAPT, Containerization, AI Platforms, Kubernetes, Bug Reporting, Metasploit, Graphql, Hardware Infrastructure - **Published:** October 16, 2026 - **Apply:** https://r1rcm.wd1.myworkdayjobs.com/R1RCM/job/Remote-USA/US-IT-Security-Eng-Sr_R260000007339 ## About the Role * 5+ years of hands-on experience in penetration testing or offensive security, spanning both infrastructure/network and application security testing. * At least one recognized offensive security certification - e.g., OSCP, GPEN, GWAPT, GXPN, CEH, or equivalent demonstrated hands-on skill - with a track record of pursuing further certification. * Practical experience testing in multiple cloud environments (AWS, Azure, and/or GCP), not just on-prem infrastructure. * Working knowledge of established methodologies and frameworks: MITRE ATT&CK, the OWASP Testing Guide, and PTES. * Fluency with both open-source and commercial security tooling (e.g., Burp Suite, Zap, Nmap, Metasploit, BloodHound, Nuclei, OWASP ZAP) and the judgment to pick the right tool for the job. * Scripting or automation ability (Python, PowerShell, or Bash) to build custom tooling and speed up repeatable testing. * Experience operating in environments subject to HIPAA, SOC 2, and/or PCI DSS. * Strong written and verbal communication - you can explain a finding's real-world impact to an engineer and to a non-technical stakeholder in the same afternoon. * Comfort operating independently inside a large, fast-paced, matrixed organization. Preferred Qualifications * Advanced certifications: OSWE, OSCE/OSEE, GXPN, CISSP, or CCSP. * Experience testing containerized environments and Kubernetes. * API security testing experience (REST/GraphQL), beyond standard web app testing. * Familiarity with CI/CD pipeline security and secure SDLC integration. * Experience contributing to or maintaining open-source security tools. * Healthcare, healthcare IT, or financial services industry experience. * Experience with AI models, harnesses, and exploiting AI services. ## Description The Offensive Security team is hiring a Senior IT Security Engineer to strengthen how we find and fix vulnerabilities before attackers do. You'll run hands-on penetration tests across infrastructure, networks, and applications, work across multiple cloud environments, and help mature testing methodology and tooling for a healthcare technology company operating at real scale. This is an individual contributor role with room to shape process, not just execute against a checklist. Responsibilities * Plan and execute penetration tests across internal and external infrastructure, networks, and web and mobile applications. * Perform application security testing - manual and tool-assisted - integrated into the SDLC, including source-code-assisted ("gray box") testing where applicable. * Test across multiple cloud environments (AWS, Azure, and/or GCP), including cloud configuration, IAM, and workload-level exposures. * Simulate real-world adversary techniques against production and pre-production systems, in coordination with engineering and infrastructure owners. * Build, maintain, and extend a toolkit spanning both open-source and commercial tooling; write custom scripts and tools to close gaps in existing coverage. * Document findings with clear risk ratings, reproduction steps, and remediation guidance, for both engineering teams and executive stakeholders. * Partner with engineering, infrastructure, and product teams to validate fixes and reduce time-to-remediation. * Support testing tied to compliance obligations, including HIPAA, SOC 2, and PCI DSS assessments and audits. * Track emerging attack techniques, exploits, and threat intelligence relevant to healthcare and revenue cycle technology environments. * Contribute to tabletop exercises, purple-team collaboration, and internal security training as needed.