Description
The Doctors Company has an opportunity for an Information Security Engineer. This is a hybrid opportunity based at our office in Napa, CA or Sherman Oaks, CA.
Position Summary
The Information Security Engineer protects the organization’s systems and data by owning day-to-day vulnerability management while serving as a first-tier responder for security alerts and incidents. In this role, you will run vulnerability scanning, prioritize findings by real-world risk, and partner with IT and operations teams to see remediation and patching through to completion. You will also triage and investigate alerts from EDR, email security, SIEM, and other security platforms, closing out false positives and escalating real threats through our incident response process. You will support security assessments of internal and third-party systems, perform configuration compliance reviews, and be responsible for deploying new security controls and tuning existing ones. You will work independently within a highly technical security engineering team and collaborate closely with management, senior security staff, and IT, operations, and app/dev teams.
Scheduling Requirements:
- Able to work a weekday shift aligned with West Coast hours, ending at 5:00pm Pacific Time.
- Able to serve in a 24/7/365 on-call rotation with other team members for incident response escalations and system failures on assigned systems.
Required Qualifications:
- A Bachelor's degree in Cyber Security, Computer Science, or a related field, or equivalent practical experience demonstrated through work history and certifications.
- 3+ years in information security, systems/network administration, or IT operations, including at least 1 year handling security alerts and tickets in a SOC, vulnerability management, or incident response role.
- Hands-on experience running an enterprise vulnerability management platform (e.g., Rapid7, Tenable, Qualys), including authenticated and agent-based scanning, scan scheduling, and fixing coverage gaps.
- Ability to prioritize findings by real-world risk, not just CVSS score, using exploitability data (CISA KEV, EPSS), asset criticality, and exposure.
- Experience driving remediation through IT and application owners: tracking findings against SLAs, validating fixes, managing exceptions, and holding teams accountable by reporting performance metrics to leadership.
- Ability to quickly assess exposure to newly disclosed, high-profile vulnerabilities and proactively communicate the impact and next steps.
- Experience triaging EDR alerts (e.g., Microsoft Defender, CrowdStrike Falcon), including process-tree and command-line analysis and containment actions.
- Experience investigating phishing and email security alerts (e.g., Proofpoint, Mimecast), including header and SPF/DKIM/DMARC analysis and URL/attachment sandboxing.
- Familiarity with investigating compromised accounts in Entra ID/Microsoft 365 or Okta and containment steps.
- Proficiency writing SIEM queries in KQL to investigate alerts, pivot across log sources, and build timelines.
- Working knowledge of the incident response lifecycle (e.g., NIST SP 800-61) and MITRE ATT&CK, with sound judgment on when to close, contain, or escalate.
- Solid knowledge of administering Windows/Active Directory and Linux-based systems.
- Familiarity with the OSI model and experience analyzing packet captures.
- Clear writing and attention to detail, ensuring excellent incident documentation, ticket notes, and executive summaries.
- Ability to influence remediation priorities across teams without direct authority.
- An autodidactic nature, with a strong drive to learn new skills without outside assistance.
Preferred Qualifications:
- CISSP certification is highly desired but not required. Any candidate selected for this role without an active CISSP is expected to pursue certification as part of their long-term career growth plans. Other certifications from bodies such as ISC2, ISACA, SANS/GIAC, IAPP, and EC-Council, as well as vendor-specific certifications, are also highly desirable.
- Experience tuning detections and suppression rules to reduce false positives.
- Experience with SOAR and/or workflow automation (e.g., Rapid7 InsightConnect, Palo Alto XSOAR).
- Cloud security experience in Azure, including container security.
- Working knowledge of patch and configuration management tools (e.g., Tanium, Intune).
- System hardening experience using CIS Benchmarks.
- Familiarity with forensic fundamentals and preservation of evidence.
Responsibilities:
Security Operations
- Automation of repetitive tasks to improve productivity and decrease manual system monitoring labor.
- Continuous tuning of security alerts to reduce false positive rates and unactionable ticket volume.
- Development of end-user targeted documentation and communications to reduces ticket volume.
- Development of helpdesk/IAM targeted documentation, training, and task shadowing to reduce escalation volume.
- Completion, reassignment, or escalation of all assigned tickets, system monitoring tasks, and other duties within SLAs.
Program Management
- Conducting vendor health-checks, capacity planning, and new feature road-mapping exercises.
- Producing yearly budgets (including license count updates, new features requests, and business justifications).
- Creating new alerts, forms, workflows, and reports/dashboards, using external tools when appropriate (Sumo, Power BI, FreshService, etc.).
- Maintaining system designs, data flow diagrams, procedures, and other documentation
- Automation and tuning of system health checks (SolarWinds, manual validations docs, Etc.).
- Improving self-assessed ability scores of all Engineering and IAM team members through cross training.
- Ensuring all systems are periodically updated, patched, and maintained in excess of normal patching SLAs.
Project/Task Management
Recognize and fill gaps in our security program by:
- Identifying needs and building proposals documenting feasibility, costs, and benefits.
- Working with stakeholders to gather requirements, scope of work, and evaluation criteria.
- Soliciting and reviewing vendor proposals, evaluating bids and presenting recommendations.
- Presenting proposed technologies to the enterprise architecture board.
Ensure successful and cost-effective completion of new capital projects by:
- Developing and communicating project strategy, success criteria, and metrics to the project team.
- Developing and updating WBS, Gants charts, or other reports to periodically communicate project status.
- Monitoring project critical path to ensure project milestones are completed on schedule.
Ensure cost-effective completion of all assigned tasks by:
- Actively participating in meeting to represent company security interests.
- Understanding, accepting, and prioritizing your assigned tasks.
- Communicating potential task obstacles to leadership or project owners.
- Completing all tasks and project deliverables on time, to specification, and within customer expectations.
Incident Management
- Proactively contribute to company incident response, threat hunting, and table-top activities.
- Create, update, and maintain incident response playbook procedures.
- Acknowledge and respond to all pager duty escalations in accordance with company SLAs.
- Cross train and serve in multiple incident response roles when required.
Vulnerability and Risk Management
- Identifying and implementing organization wide security corrections (using group policy, Tanium/Kace, image hardening, etc.).
- Taking a lead role in driving correction of assessment, pen test, table-top, and SPMA identified issues.
- Leading by example, keeping all assigned systems updated and patched in excess of required SLAs.
- Maintain the company risk register, participating in yearly reviews and making out of cycle additions when appropriate.
- Developing, maintaining, and executing a variety of risk assessment procedures and workflows.
- Documenting and escalating significant risks to security leadership.
Customer Service & Security Advocacy
- Exemplify company values and security best practices in all actions.
- Create a safe, welcoming environment that encourages users to report security issues.
- Fully understand and respect customer needs and the impediments security controls pose.
- Offer alternative options and escalation paths when denying requests.
- Ensure a soft transition when escalating to other resources.
Salary Range: $75,820 - 104,102
This position is eligible for participation in the Company's Short-Term Incentive Plan (STIP), offering additional compensation driven by individual and company performance.
Compensation is determined based on factors such as skills, experience, education, and market considerations. We consider factors such as specialized skills, depth of knowledge in the field, and educational background to ensure fair and competitive pay. Salary may also include additional geographic differential for employees working in higher-cost labor markets, including states such as New York and California. While the posted range reflects our anticipated hiring range, we remain open to considering candidates with exceptional qualifications, specialized expertise, or directly relevant experience that may warrant compensation outside of that range.
Benefits
We offer competitive compensation, an incentive bonus plan, outstanding career opportunities, an exceptional work environment, and an impressive benefits package, which starts with medical, family and bereavement leave; same-sex domestic partner benefits; short- and long-term disability programs; and an employee assistance program. There's more:
- Health, dental, and vision insurance
- Health care tax-free spending accounts with a company match
- 401(k) and Roth IRA with company match, as well as catch-up plans for both
- Vacation days, sick days, and paid personal days each calendar year (with vacation increases based on length of service)
- Paid holidays each calendar year
- Life and travel insurance
- Tax-free commuter benefits
- In-person and online learning opportunities
- Cross-function career opportunities
- Business casual work environment
- Time off to volunteer
- Matching donations to qualifying nonprofit organizations
- Company-sponsored participation at non-profit events
About The Doctors Company
The Doctors Company is the nation’s largest physician-owned medical malpractice insurer. Founded and led by physicians, we are committed to advancing, protecting, and rewarding the practice of good medicine.
The Doctors Company is proud to be Certified™ by Great Place to Work®.