Hiring a SENIOR MANAGER, SECURITY OPERATIONS & GOVERNANCE with prior experience in healthcare industry, Microsoft environment (365,InTune, Azure Security) and coordinating remediation across technical teams, vendors, business owners, and compliance stakeholders.
Location: 100% remote in US
Duration: 6-12 month contract
Pay: $70-80/hr W2
This role will serve as the primary owner for security findings, remediation plans, vulnerability items, audit actions, risk exceptions, and enterprise security obligations.
The position requires a hands-on leader who can translate security findings into practical action plans, assign ownership, track execution, validate evidence, escalate blockers, and drive closure across IT, compliance, vendors, and business stakeholders.
The ideal candidate is not only able to organize and execute a security program but is also a security-minded operator who can work directly with technical teams on identity, endpoint, cloud, network, application, infrastructure, SaaS, and healthcare system risks.
-
Own the security remediation backlog, including enterprise security findings, IOPs, vulnerability items, audit actions, risk assessments, control gaps, exceptions, and assessment findings.
-
Drive remediation from intake through closure by creating clear action plans with owners, due dates, dependencies, evidence requirements, risks, and escalation paths.
-
Maintain a centralized remediation tracker, risk register, exception log, evidence repository, and executive status reporting for open security obligations.
-
Lead recurring remediation reviews with infrastructure, cloud, endpoint, application, network, data, compliance, and vendor teams to ensure progress and accountability.
-
Challenge unclear ownership, stalled work, weak evidence, missed deadlines, and incomplete remediation plans.
-
Escalate blockers and risks to IT leadership, Enterprise Security, Compliance, and business owners when remediation is delayed or requires risk acceptance.
-
Validate remediation evidence before closure, including screenshots, configuration exports, tickets, logs, reports, policy updates, testing results, and vendor attestations.
-
Translate technical findings into practical, prioritized work that operational teams can execute without unnecessary complexity.
-
Lead security operations activities, including alert triage, investigation, containment, escalation, recovery, and post-incident review.
-
Serve as incident commander or technical lead for security events affecting clinical operations, patient data, business continuity, or critical applications.
-
Maintain incident documentation, evidence, playbooks, tabletop exercises, and after-action tracking.
-
Partner with Compliance/Privacy on PHI related investigations, documentation, and reporting requirements.
-
Lead vulnerability lifecycle management, including intake, validation, prioritization, ticketing, remediation follow-up, SLA adherence, aging reporting, and closure evidence.
-
Coordinate with application, infrastructure, cloud, network, and vendor owners to remediate application, website, domain, certificate, configuration, cloud, server, endpoint, and external exposure findings.
-
Manage and improve security practices across identity, endpoint, email, cloud, network, server, SaaS, and application environments.
-
Oversee operational use of Microsoft 365 security, Entra ID, Intune, Defender, Sentinel, Azure security, EDR/XDR, SIEM, vulnerability management tools, and related logging or investigation capabilities.
-
Partner with infrastructure, cloud, and network teams on secure administration, segmentation, firewall standards, NAC, remote access, vendor access, and external exposure management.
-
Drive endpoint and workstation security improvements, including EDR coverage, encryption, patching, device compliance, configuration baselines, and exception handling.
-
Ensure security telemetry from endpoints, identity, email, cloud, EHR, Salesforce, and critical infrastructure is available for monitoring, investigation, and audit evidence.
-
Support access management governance, including onboarding/offboarding controls, periodic access reviews, privileged access, service accounts, vendor access, and remote access.
-
Coordinate vendor security reviews and remediation for third parties with access to PHI, patient data, or critical systems.
-
Document compensating controls and risk acceptance where immediate remediation is not feasible.
-
Support HIPAA Security Rule safeguards, PHI/PII protection, secure email, DLP, data classification, application inventory, and evidence management activities.
-
Partner with clinical, operations, IT, and compliance stakeholders to reduce risk to patient data and clinical operations.
-
Support business continuity and disaster recovery planning, including recovery procedures, system dependencies, testing evidence, and remediation of gaps.
-
Coordinate security work related to medical devices, telecom, specialty systems, hosted environments, and healthcare-specific technology risks.
-
Maintain practical security policies, standards, procedures, and evidence that can be followed by operational teams.
-
Bachelor's degree and 8+ years of experience managing enterprise IT, cybersecurity, security operations, or security remediation programs. Additional years of relevant experience may be considered in lieu of degree.
-
Experience owning remediation programs where findings, vulnerabilities, audit actions, or risk items had to be driven to closure across multiple technical and business teams.
-
Ability to operate as an execution owner, not only a coordinator, including assigning work, challenging status, escalating blockers, validating evidence, and holding teams accountable.
-
Strong practical understanding of vulnerability management, security operations, incident response, identity security, endpoint protection, cloud security, logging, and control evidence.
-
Experience working with enterprise security, audit, compliance, or corporate security teams on remediation plans, exceptions, evidence requests, and recurring status reporting.
-
Experience engaging multidisciplinary technical teams across cloud, cybersecurity, infrastructure, endpoint, network, application, SaaS, and hybrid environments.
-
Experience managing scope, schedule, priority, risk, and dependencies for enterprise security initiatives.
-
Working knowledge of Microsoft 365 security, Entra ID, Intune, Defender, Sentinel, Azure security, EDR/XDR, SIEM, IAM, vulnerability management tools, and logging concepts.
-
Experience coordinating remediation across technical teams, vendors, business owners, and compliance stakeholders.
-
Ability to review findings, determine practical next steps, assign ownership, track progress, collect evidence, and escalate blockers.
-
Familiarity with HIPAA, PHI/PII handling, NIST CSF, CIS benchmarks, and modern identity and endpoint security practices.
-
Strong written and verbal communication skills, including the ability to explain technical risk and remediation status to non-technical stakeholders.
-
Healthcare experience or experience supporting regulated environments with sensitive data.
-
Relevant certifications such as PMP, CISSP, CISM, CRISC, Security+, or similar are preferred.
Determining compensation for this role (and others) at Vaco/Highspring depends upon a wide array of factors including but not limited to the individual’s skill sets, experience and training, licensure and certifications, office location and other geographic considerations, as well as other business and organizational needs. With that said, as required by local law in geographies that require salary range disclosure, Vaco/Highspring notes the salary range for the role is noted in this job posting. The individual may also be eligible for discretionary bonuses, and can participate in medical, dental, and vision benefits as well as the company’s 401(k) retirement plan. Additional disclaimer: Unless otherwise noted in the job description, the position Vaco/Highspring is filing for is occupied. Please note, however, that Vaco/Highspring is regularly asked to provide talent to other organizations. By submitting to this position, you are agreeing to be included in our talent pool for future hiring for similarly qualified positions. Submissions to this position are subject to the use of AI to perform preliminary candidate screenings, focused on ensuring minimum job requirements noted in the position are satisfied. Further assessment of candidates beyond this initial phase within Vaco/Highspring will be otherwise assessed by recruiters and hiring managers. Vaco/Highspring does not have knowledge of the tools used by its clients in making final hiring decisions and cannot opine on their use of AI products.
Vaco by Highspring is an Equal Opportunity Employer and does not discriminate against any employee or applicant for employment because of race (including but not limited to traits historically associated with race such as hair texture and hair style), color, sex (includes pregnancy or related conditions), religion or creed, national origin, citizenship, age, disability, status as a veteran, union membership, ethnicity, gender, gender identity, gender expression, sexual orientation, marital status, political affiliation, or any other protected characteristics as required by federal, state or local law.
Vaco by Highspring and its parents, affiliates, and subsidiaries are committed to the full inclusion of all qualified individuals. As part of this commitment, Vaco by Highspring and its parents, affiliates, and subsidiaries will ensure that persons with disabilities are provided reasonable accommodations. If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or to receive other benefits and privileges of employment, please contact [email protected].
Vaco by Highspring also wants all applicants to know their rights that workplace discrimination is illegal.
By submitting to this position, you agree that you will be giving Vaco by Highspring the exclusive right to present your as a candidate for the foregoing employment opportunity. You further agree that you have represented information about yourself accurately and have not affirmatively misrepresented your qualifications. You also agree to maintain as confidential, to the fullest extent permitted by law, any information you learn from Vaco by Highspring about the position and you will limit disclosure of information about the position only to the extent necessary to perform any obligations in furtherance of your application. In exchange, Vaco by Highspring agrees to exercise reasonable efforts to represent you through all solicitation, job screening and resume dispersal.
For residents of Ontario, Canada: Based on Highspring’s discussions with its Client, Highspring’s understanding is that this position for employment is a current vacancy (either through Highspring as a contractor or with the client directly).
Vaco by Highspring and its parents, affiliates, and subsidiaries (“we,” “our,” or “Vaco by Highspring”) respects your privacy and are committed to providing transparent notice of our policies.
- California residents may access Vaco by Highspring HR Notice at Collection for California Applicants and Employees here.
- Virginia residents may access our state specific policies here.
- Residents of all other states may access our policies here.
- Canadian residents may access our policies in English here and in French here.
- Residents of countries governed by GDPR may access our policies here.
Additionally, submissions to this position are subject to the use of AI to perform preliminary candidate screenings, focused on ensuring minimum job requirements noted in the position are satisfied. More details about Vaco by Highspring’s use of AI can be found here (https://www.highspring.com/ai-use-notices/). Further assessment of candidates beyond this initial phase will be conducted by recruiters and hiring managers. Vaco by Highspring does not know and cannot opine on if its client’s use of AI products in hiring.
Determining compensation for this role (and others) at Vaco by Highspring depends upon a wide array of factors including but not limited to:
- the individual’s skill sets, experience and training;
- licensure and certification requirements;
- office location and other geographic considerations;
- other business and organizational needs.
With that said, as required by local law, Vaco by Highspring believes that the following salary range referenced above reasonably estimates the base compensation for an individual hired into this position in geographies that require salary range disclosure. The individual may also be eligible for discretionary bonuses.
