Cloud Security Engineer Principal

SHIFT:

Seeking Breakthrough Makers

Children's Hospital of Philadelphia (CHOP) offers countless ways to change lives. Our diverse community of more than 20,000 Breakthrough Makers will inspire you to pursue passions, develop expertise, and drive innovation.

At CHOP, your experience is valued; your voice is heard; and your contributions make a difference for patients and families. Join us as we build on our promise to advance pediatric care-and your career.

CHOP's Commitment to Diversity, Equity, and Inclusion

CHOP is committed to building an inclusive culture where employees feel a sense of belonging, connection, and community within their workplace. We are a team dedicated to fostering an environment that allows for all to be their authentic selves. We are focused on attracting, cultivating, and retaining diverse talent who can help us deliver on our mission to be a world leader in the advancement of healthcare for children.

We strongly encourage all candidates of diverse backgrounds and lived experiences to apply.

A Brief Overview

The Cloud Security Engineer will play a pivotal role in the cloud security servicedelivery model. The role combines deep technical expertise, collaboration across internal and external teams to design, implement, and optimize cloud security controls and service lines. The candidate will support both project-based and continuous security initiatives, focusing on securing CHOP's cloud migration, supporting cloud security tool optimization, cloud security processes for the Information Security team, cloud/hybrid controls, automation, and risk-driven security outcomes.

• Proven experience in securing a multi-cloud environment.

• Proven experience with Identity and access management in the cloud

• Proven experience with all security service lines in a cloud envrionment and the supporting security tools and processes to be successful.

• Demonstrate collaboration with internal stakeholders, vendors,and supporting teams to design, implement, and maintain security technologies across network, endpoint, identity, and cloud infrastructure.

• Drive continuous improvement and coverage of cloud security controls by validating alerts, triaging escalations, and working with the MSP to fine-tune detection and prevention capabilities.

• Lead or support the development of incident response plans, engineering runbooks, tabletop exercises, and system hardening guides.

• Ensure alignment of security architectures with CHOP's policies, standards, and external frameworks such as NIST SP 800-53, HIPAA, PCI-DSS, CISA ZTMM, CIS Benchmarks, and Microsoft CAF Secure Methodology, AWS CAF, AWS Well Architected framework, Google CAF

• Participate in design and governance forums to provide security input into infrastructure, DevSecOps, and cloud-native application strategies.

• Assist with audits, compliance assessments, risk remediation plans, and evidence collection with internal compliance and external third-party stakeholders.

• Mentor and support junior InfoSec engineers through documentation, training, and peer reviews.

• Hands-on experience in security engineering, systems integration, and cloud architecture (Azure preferred).

• Proficiency in tools and domains such as: EDR (Microsoft Defender), SIEM (Sentinel or Splunk), CSPM (e.g., Wiz), IAM (Entra ID), VPNs/NGFWs, NAC, and encryption protocols.

• Demonstrated understanding of secure configuration management, automation pipelines (e.g., Terraform, PowerShell), and vulnerability management platforms.

What you will do

• A Principal Information Security Specialist has similar responsibilities to Information Security Specialist III personnel. However, a Principal Information Security Specialist is deemed to be the subject matter expert and in-house advisor on complex problems and issues. A Principal Information Security Specialist also:
• Works independently to initiate assignments and draws upon extensive professional knowledge and experience to make independent judgments regarding analysis, evaluation, development, and implementation of enterprise long-term solutions and operating initiatives to ensure that enterprise architectural objectives are aligned with organizational needs and strategic goals.
• Optimizes information management approaches through an understanding of evolving business needs and technology capabilities and ensures that projects do not duplicate functionality or diverge from each other and business and DTS strategies.
• Shapes, designs, and plans specific service lines in product area and manages the risks associated with information and DTS assets through appropriate standards and security policies.
• Functions as the Subject Matter Expert (SME) to maintain an understanding of CHOP DTS business and clinical applications and the relationship to InfoSec and compliance solutions; assist Hospital stakeholders in understanding information protection needs that support the Hospital's business.
• Works with other architects to provide a consensus based enterprise solution that is scalable, adaptable and in synchronization with ever changing business needs and takes ownership of a particular solution offering.
• Works with highly matrixed team of DTS personnel to support enterprise architecture and information security operations including, but not limited to, architecture and InfoSec principles around identity & access management models, cloud identify management providers, security information and event monitoring, and data loss prevention, perimeter (e.g. firewalls, IPS, web filtering), cloud and virtualization environments and network security (host-based firewalls, anti-virus, disk encryption).
• Support and/or lead activities around InfoSec standards for business continuity and change management activities (e.g., table tops and change review board) and educates DTS Hospital management on security issues (e.g., Identity and Access Management (IAM), Role Based Access Control (RBAC) models.

The department works approximately 80% remotely, 20% on site in our Philadelphia offices on an as-needed basis.

Education Qualifications

• Bachelor's Degree Required
• Bachelor's Degree Computer Science, Information Systems, or related field Preferred

Experience Qualifications

• At least twelve (12) years industry related experience, including experience in one to two IT disciplines (such as technical architecture, network management, application development, middleware, information analysis, database management or operations) in a multitier environment. Required and
• At least six (6) years experience with information security, regulatory compliance and risk management concepts. Required and
• At least three (3) years experience with Identity and Access Management, user provisioning, Role Based Access Control, or control self-assessment methodologies and security awareness training. Required and
• Experience with Cloud and/or Virtualization technologies. Required
• At least three (3) years in working with matrixed high performance teams. Preferred

Preferred Qualifications

• Preferred relevant certifications: Sec+,Azure Security Engineer (SC-200), CCSP, GSEC, or equivalent.

• Experience developing or contributing to cloud governance, tagging standards, or infrastructure-as-code (IaC) security policies.

• Experience in healthcare, research, or life sciences environments is highly desirable.

• Strong interpersonal and communication skills; ability to convey technical concepts to non-technical stakeholders.

Skills and Abilities

• Demonstrates comprehensive knowledge and understanding of Information security principles, general and IT controls (e.g., access controls, risk management, change management, cloud security) and related information security policies and procedures.
• Exhibits knowledge of industry regulatory standards and accreditation requirements or control frameworks (HIPAA, PCI, Joint Commission, NIST, Red Flags, ISO 27000 series).
• Comprehensive knowledge of information security regulations, standards and leading practices, including understanding of EHR, cloud frameworks, identity access controls.
• Good knowledge of basic database query techniques & data mining to analyze data or other related database functionality.
• Knowledge of Microsoft Active Directory, UNIX, and Clinical Applications a plus.
• Experience implementing application level security in clinical and financial systems (e.g., Epic, Lawson). ERP experience a plus.
• General understanding of networking and communication techniques including WANs, LANs, Internet, Intranet, protocols, such as TCP/IP and their impact on security.
• Microsoft, UNIX, Lawson, and Clinical Applications,
• Experience with industry standard SDLC methodologies; hands-on experience in Project Server methodologies, PMO project management skills, including use of MS productivity tools (Access, Word, PowerPoint, Visio, Project).
• Experience with risk management frameworks.
• Information Security Requirements
• Understand and comply with all enterprise and IS departmental information security policies, procedures and standards.
• Support the integration of information security in the development, design, and implementation of Hospital Technology Resources that process, transmit, or store CHOP information.
• Support all compliance activities related to state, federal regulatory requirements, healthcare accreditation standards, and all other applicable regulations that govern the use and disclosure of patient, financial, or other confidential information.

Licenses and Certifications

• Certified Information Systems Security Professional (CISSP) - Information Systems Audit and Control Association (ISACA) - upon hire - Preferred or
• HealthCare Information Security and Privacy Practitioner (HCISPP) - Information Systems Audit and Control Association (ISACA) - upon hire - Preferred or
• Certified in Cybersecurity - Information Systems Audit and Control Association (ISACA) - upon hire - Preferred or
• Systems Security Certified Practitioner (SSCP) - Information Systems Audit and Control Association (ISACA) - upon hire - Preferred or
• Certified Information Security Manager (CISM) - Information Systems Audit and Control Association (ISACA) - upon hire - Preferred or
• Certified Information Systems Auditor (CISA) - Information Systems Audit and Control Association (ISACA) - upon hire - Preferred or
• Certified in the Governance of Enterprise IT (CGEIT) - Information Systems Audit and Control Association (ISACA) - upon hire - Preferred or
• Certified in Risk and Information Systems Control (CRISC) - Information Systems Audit and Control Association (ISACA) - upon hire - Preferred or
• CompTIA Security+ - CompTIA - upon hire - Preferred or
• GIAC Security Essentials (GSEC) - GIAC Certifications - upon hire - Preferred or
• Certified Ethical Hacker (CEH) - EC-Council - upon hire - Preferred or
• Certificate of Cloud Security Knowledge (CCSK) - Cloud Security Alliance (CSA) - upon hire - Preferred or
• Certificate of Cloud Auditing Knowledge (CCAK) - Cloud Security Alliance (CSA) - upon hire - Preferred

To carry out its mission, CHOP is committed to supporting the health of our patients, families, workforce, and global community. As a condition of employment, professionals working onsite-at any CHOP location, for any portion of time-must be vaccinated for COVID-19. Learn more.

EEO / VEVRAA Federal Contractor | Tobacco Statement

SALARY RANGE:

Salary ranges are shown for full-time jobs. If you're working part-time, your pay will be adjusted accordingly.

-------------------

At CHOP, we are committed to fair and transparent pay practices. Factors such as skills and experience could result in an offer above the salary range noted in this job posting. Click here for more information regarding CHOP's Compensation and Benefits.