Security Engineer

We are seeking a hands-on Security Engineer with strong technical depth across endpoint, cloud, identity, and email security. This role designs, deploys, and operates Iovance’s core security platforms, including CrowdStrike Falcon EDR and Next-Gen SIEM, privileged access management, Mimecast, AWS security services, and GitHub security. The right candidate builds policy, writes detections and automation, troubleshoots across the stack, and documents their work to the standard expected in a validated, audit-ready environment.

Essential Functions and Responsibilities

Endpoint Detection, SIEM & Response (CrowdStrike)

• Administer and tune CrowdStrike Falcon prevention policies, host groups, device control, and sensor updates across Windows, macOS, and Linux, with careful exclusion management for GxP and manufacturing systems.
• Onboard and normalize log sources (Okta, AWS, Mimecast, GitHub, PAM, servers) into Falcon Next-Gen SIEM, and build detections, dashboards, and Falcon Fusion SOAR workflows.
• Investigate alerts, conduct threat hunting, and drive containment and remediation.

Privileged Access Management

• Operate the enterprise PAM platform, including vaulting, credential rotation, session recording, and just-in-time access for servers, cloud accounts, databases, and service accounts.
• Integrate PAM with Okta and Active Directory, and support privileged access reviews and segregation-of-duties controls.

Email Security (Mimecast)

• Administer Mimecast targeted threat protection, DLP, archiving, and continuity policies, and maintain SPF, DKIM, and DMARC.
• Investigate phishing, impersonation, and business email compromise attempts.

Cloud & DevSecOps Security (AWS, Microsoft 365 & GitHub)

• Secure AWS workloads including EC2, ECS, ELB/ALB, S3, and VPC networking, using AWS WAF, IAM, KMS, GuardDuty, Security Hub, Config, and CloudTrail.
• Identify and remediate misconfigurations, enforce least privilege, and review infrastructure-as-code (Terraform/CloudFormation).
• Harden and monitor Microsoft 365, including Entra ID Conditional Access, Exchange Online, SharePoint/OneDrive/Teams sharing controls, Microsoft Purview DLP and sensitivity labels, and Microsoft Secure Score recommendations.
• Administer GitHub Advanced Security (code scanning, secret scanning, Dependabot), branch protection, and organization policies, and secure GitHub Actions pipelines using OIDC federation to AWS.

Governance, Compliance & Operations

• Author technical documentation, standards, and runbooks suitable for GxP, SOX, and HIPAA audits, and provide audit evidence.
• Participate in change control, vulnerability and patch management, incident response, and on-call rotation.

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience.
• 5+ years of hands-on experience in security engineering or cloud security.
• Hands-on experience with CrowdStrike Falcon EDR and a SIEM platform, preferably Falcon Next-Gen SIEM (LogScale), including detection development.
• Experience administering an enterprise PAM solution (e.g., CyberArk, BeyondTrust, Delinea).
• Experience with Mimecast or a comparable secure email gateway.
• Practical experience securing AWS environments (EC2, ECS, ELB, S3, WAF, IAM, VPC).
• Hands-on experience securing Microsoft 365, including Entra ID, Conditional Access, Exchange Online, and Purview.
• Working knowledge of GitHub security features and CI/CD security.
• Solid foundation in networking, DNS, TLS, and identity protocols (SAML, OIDC, OAuth, LDAP).
• Scripting experience in Python, PowerShell, or Bash.
• Strong written communication and audit-ready documentation skills.

Preferred Education, Skills, and Knowledge

• Experience in a regulated life sciences or healthcare environment (GxP, 21 CFR Part 11, HIPAA, SOX).
• Experience with Okta and Microsoft Entra ID/Intune.
• Familiarity with Terraform, NIST CSF, NIST 800-53, and CIS Controls.
• Certifications such as CrowdStrike CCFA/CCFR/CCFH, AWS Certified Security - Specialty, CISSP, or GIAC.

Physical Demands and Activities Required

The physical demands described here represent those an employee may encounter while performing the essential functions of this job. Reasonable accommodation may be provided to enable individuals to perform these functions.

• Ability to remain in a stationary position for extended periods
• Ability to move about within an office or remote workspace and exert up to 10 pounds of force occasionally
• Visual acuity sufficient for preparing and analyzing data, viewing computer screens, and extensive reading
• Repetitive motion involving wrists, hands, and/or fingers
• Ability to communicate effectively to exchange information
• Ability to engage in analytical, conceptual, and problem-solving activities in a dynamic business environment

Mental: Clear and conceptual thinking ability; excellent judgment, troubleshooting, problem-solving, analysis, and discretion; ability to handle work-related stress; ability to handle multiple priorities simultaneously with a sense of urgency; and ability to meet deadlines

Designs, deploys, and operates security platforms across endpoints, cloud, identity, email, privileged access, and GitHub. Administers CrowdStrike, SIEM, PAM, Mimecast, AWS, Microsoft 365, and GitHub security controls; develops detections, automation, and SOAR workflows; investigates threats; secures cloud and CI/CD environments; and supports vulnerability management, incident response, audits, documentation, and on-call operations in a regulated environment. The summary above was generated by AI, The annual base salary we reasonably expect to pay is listed. Individual pay decisions depend on various factors, such as primary work location, complexity and responsibility of the role, job duties/requirements, and relevant education, experience and skills. Pay Transparency $125,000-$140,000 USD

The statements contained in this document are intended to describe the general nature and level of work being performed by a colleague assigned to this description. They are not intended to constitute a comprehensive list of functions, duties, or local variances. Management retains the discretion to add or to change the duties of the position at any time.

Iovance Biotherapeutics, Inc. is the global leader in innovating, developing, and delivering tumor infiltrating lymphocyte (TIL) cell therapies for patients with solid tumors. Amtagvi® (lifileucel) is the first FDA-approved, one-time treatment for previously treated advanced melanoma, now approved in three global markets and available at more than 95 authorized treatment centers. The Iovance TIL platform spans registrational trials and next-generation programs in additional solid tumors, including gene-edited and IL-12 tethered TIL therapies, next-generation IL-2, and precision immuno-oncology approaches. As the first and only company to take TIL therapy from concept to a broadly accessible commercial treatment, Iovance operates as an end-to-end cell therapy company, anchored by fully owned, centralized U.S.-based manufacturing that is scaled to serve thousands of cancer patients worldwide each year. For more information, please visit www.iovance.com.

Amtagvi® and its accompanying design marks, Proleukin®, Iovance®, and IovanceCares are trademarks and registered trademarks of Iovance Biotherapeutics, Inc. or its subsidiaries. All other trademarks and registered trademarks are the property of their respective owners.

Information on Iovance’s broad, industry-leading patent portfolio is available on the Intellectual Property page on www.iovance.com.