Cybersecurity Engineer

About DrFirst For 25 years, DrFirst has empowered providers and patients to achieve better health through intelligent medication management. We improve healthcare workflows and help patients start and stay on therapy with end-to-end solutions that enhance prescription access, affordability, and adherence. Our solutions help 100 million patients a year and are used by more than 420,000 prescribers, 71,000 pharmacies, 270 EHRs and health information systems, and over 2,000 hospitals in the U.S. This is a great opportunity to be a part of a successful Healthcare IT company experiencing significant growth. Here you'll get to work with some of the smartest and most interesting people around; solving unique and complex challenges in healthcare on a scale matched by a few companies. If you get excited about stretching yourself in new ways, developing yourself to your fullest potential, care about working with smart colleagues; we want to talk to you! Position Overview At DrFirst , we play in the major leagues. Our 5-person security team covers what most organizations staff with ten or more — not by working longer, but by working smarter. We are adding a Cybersecurity Engineer to grow that team, and we are looking for someone who earns their place as an engineer — not an analyst. The difference matters. Analysts follow playbooks. Engineers understand the systems well enough to know when something is wrong — and to build the automation that catches it faster next time. You will triage alerts, complete security risk assessments, contribute to DevSecOps, and collect audit evidence. But you will do all of it with enough platform depth that you can spot a misconfiguration during evidence collection, not just screenshot and move on. More importantly, you use AI the way an engineer uses any powerful tool — to rethink how work gets done, not just to finish it faster. You do not just prompt Claude to complete a task. You ask whether the task should exist in its current form at all, and if not, you build something that eliminates it. You have done this already. Others would describe you this way — keep reading. What You Contribute You report to the VP Security and work alongside two Principal Security Engineers and one Senior Cybersecurity Engineer. You own your queue and contribute to shared goals. You are not handed a checklist — you are expected to understand what you are looking at. Domain Scope Cadence Security Operations Alert triage across SentinelOne, Proofpoint, Splunk, AWS Security Hub, GCP SCC, Tenable, Zscaler. Security inbox, customer questionnaires, SRAs, KnowBe4, onboarding/offboarding compliance, endpoint and allowlist controls. Steady state DevSecOps — Contributor Contribute alongside a Principal who spends 60% of his time here. Pipeline security, secure SDLC, security tooling integration. Tangible deliverables. Ongoing Security Incident Response Incident response, proactive threat prevention, security reviews for new product features. As needed Audit Evidence Collection SOC 2 / HITRUST evidence for your domains. Platform depth matters — you flag misconfigurations, not just collect screenshots. Seasonal burst What you will work on Strategic Initiatives You Step Into From Day One Active initiatives with momentum. You contribute immediately. Initiative What You Step Into Audit Evidence Automation Active initiative to automate SOC 2 / HITRUST evidence collection using Claude Code — moving the team from collectors to SME reviewers. You contribute to this from day one. Data Governance Automation Retention policy framework in progress. Drive AI-assisted implementation by data stream and category, coordinate purge processes across email and corporate data stores. Corporate Claude Environment Contribute to security architecture, guardrails, and governance for non-engineering staff using Claude for automation and data access via MCPs. How We Work Security is one of