We are currently looking for a Integration Security Engineer for a 100% remote position supporting a large federal government healthcare modernization project. This role will design, implement, and maintain security controls across healthcare interoperability platforms, with a focus on mutual Transport Layer Security (mTLS), Public Key Infrastructure (PKI), OAuth 2.0, OpenID Connect (OIDC), and SMART on FHIR authorization. The engineer will secure FHIR APIs, healthcare integration gateways, identity services, and partner data exchanges while ensuring compliance with HIPAA and federal security requirements.
The role operates in a highly collaborative environment, partnering with platform engineers, FHIR developers, integration teams, facility onboarding teams, vendors, and third-party security assessors. The engineer will support security architecture, implementation, automated security testing, compliance documentation, and pre-production security assessments.
The candidate must reside within the continental US.
Responsibilities
- Design and operate mTLS enrollment processes for healthcare facilities and partners, including certificate issuance and rotation using cert-manager, trust-store management across MLLP gateways, Apache NiFi, and CHIE adapters, and certificate revocation procedures.
- Implement and test SMART on FHIR authorization using Keycloak, including OAuth 2.0/OIDC scopes, launch contexts, purpose-of-use and charter claims, and backend-services authorization flows for FHIR Bulk Data and CDS Hooks.
- Integrate walt.id SEDI verifiable credentials for partner and patient onboarding and document credential issuance, management, and lifecycle procedures.
- Harden FHIR APIs and integration endpoints through input validation, rate limiting, Envoy Gateway configurations, WAF rules, secure error handling, Inferno and Touchstone security testing, and OWASP API security checks in CI pipelines.
- Ensure edge components generate required AuditEvents while maintaining secure HL7 v2 and Apache NiFi workflows that prevent PHI exposure outside approved data environments.
- Develop security sections for vendor integration guides, the Onboarding Toolkit, and facility security checklists while supporting secure onboarding and production cutover activities.
- Take on additional tasks and responsibilities as needed to support team objectives and ensure the success of the project.
Requirements
- Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field and 5+ years of application or cloud security engineering experience, including at least 2 years in a HIPAA-regulated environment.
- Hands-on experience with PKI, mTLS, certificate management, and certificate lifecycle technologies such as cert-manager, AWS ACM Private CA, or equivalent solutions.
- Strong experience with OAuth 2.0, OIDC, SMART on FHIR App Launch, and Backend Services authorization flows.
- Familiarity with HL7 FHIR R4 security patterns, Keycloak or comparable identity providers, and Kubernetes network policies and ingress security technologies such as Cilium and Envoy.
- Experience with scripting and CI/CD security automation using Python or Java, GitHub Actions, Trivy, software bills of materials (SBOMs), and container image signing.
- Strong understanding of HIPAA Security Rule technical safeguards, Business Associate Agreement (BAA) obligations, application security, and protection of PHI.
Additional Qualifications
- Experience implementing NIST SP 800-53 or FedRAMP Moderate security controls, including communications protection, access control, identification and authentication, and audit logging.
- Experience with ISO 27001 security practices and certifications such as Security+, CISSP, CCSP, or GIAC.
- Previous experience supporting state Health Information Exchanges (HIEs), Medicaid programs, or Department of Veterans Affairs healthcare interoperability initiatives.
- Experience with verifiable credentials, security architecture assessments, penetration testing, and healthcare API security testing using Inferno, Touchstone, and OWASP API security practices.
Security Clearance Requirements
- U.S. Citizenship is required.
- All selected candidates must successfully complete a background check.
- Ability to obtain and maintain a Government/Public Trust clearance, including required fingerprinting, when required for the position.
Benefits
- Medical/Dental/Vision
- 401k with Employer Match
- PTO + Federal Holidays
- Corporate Laptop
- Training Opportunities
- Remote Opportunity
VetsEZ is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability, or protected veteran status.
Sorry, we are unable to offer sponsorship at this time.