Corporate IT and Security Engineer

We need to output HTML fragment with sections: About the role? Actually the posting includes "About Us" and "The Role". The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Do NOT repeat the job title as a heading. So we need headings for sections that have content. We have "About Us" content: description of company. Could map to "About the role"? Actually "About Us" is about company, not role. But we could treat as "About the role"? The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. It doesn't forbid other headings? It says use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Likely they expect those headings only. So we should map content to those headings where appropriate. We have: - About Us: description of company. Could be placed under "About the role"? Might be weird. Perhaps we can omit About Us? But we must preserve ALL substantive information. Could put under a heading like "About the role" but that's not accurate. However instruction says "use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)". It doesn't say we cannot use other headings, but suggests those are typical. Safer to use those headings only. We could treat "About Us" as "About the role"? Might be acceptable. Alternatively we could create a heading "About the role" and put the company description there, plus role description? The role description is under "The Role". Could combine. But we also have sections: Core Responsibilities (list), Qualifications (list), Preferred Qualifications (list), Why Join the Zest Team? (benefits). Also there is mention of compensation package etc. We need to decide which headings to include: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We have Responsibilities: Core Responsibilities (multiple sub-sections). We can put under

Responsibilities

with

• items. We have Requirements: Qualifications (required) and Preferred Qualifications (preferred). Could combine under Requirements? Or separate Qualifications and Skills? The instruction includes Qualifications and Skills as separate headings. We could put required qualifications under

  Qualifications

  , and preferred under

  Preferred Qualifications

  but that's not in list. Might be okay to add but risk. Better to follow instruction: Use those headings only. So we need to map content to those headings. We have qualifications (required) and preferred qualifications. Could put both under Qualifications heading, maybe separate with

  or

  . Could also put preferred under Skills? Not ideal. We have benefits: "Robust compensation package inclusive of competitive pay, equity grants, and retirement plan matching. Employer-sponsored medical, dental, and vision plans". Also mention "This role is not eligible for visa sponsorship". That's not benefit. So we can create Benefits heading with those items. Pay: Not explicitly stated numbers, just "competitive pay". That's vague; we should not create Pay section unless posting actually states them. It says "competitive pay" but not specific. The instruction: never create Pay/Schedule/Benefits sections unless the posting actually states them. It says "competitive pay" is a statement but not specific number. Is that enough? Likely not; they want actual numbers or explicit mention of pay range. Since not given, we should omit Pay section. Schedule: Not mentioned; omit. Skills: Could be derived from qualifications? Might be thin. Better to omit Skills if not explicit. Thus we will have sections: About the role (maybe combine About Us and The Role), Responsibilities, Qualifications, Benefits. We need to preserve all substantive information: include company description, role description, responsibilities details, qualifications (required and preferred), benefits description, also note about visa sponsorship, EEO statement? Instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we should remove EEO statement at end. Also remove "This role is not eligible for visa sponsorship, now or in the future. Candidates must be authorized to work in the U.S. without sponsorship." That's not EEO but maybe considered legal? It's about work authorization; could be considered substantive? It's a requirement. Might be important to keep. It's not boilerplate; it's a specific eligibility requirement. Should we keep? It's not about EEO; it's about work authorization. Probably keep as part of Qualifications or a note. We'll include under Qualifications maybe as a separate bullet. Also remove duplicated lines. Now craft HTML. Structure:

  About the role

  Zest Health is redefining care for the 40M+ Americans with chronic dermatologic conditions like eczema and psoriasis. Through our virtual dermatology clinic, Zest is making care more accessible, effective, and affordable. Join our well-resourced, passionate team as we set the new gold standard for value-based specialty care. We're hiring our first dedicated Corporate IT and Security Engineer. Today these responsibilities are spread across the software engineering team. You'll take them over and build the processes that let us grow without security and compliance becoming a bottleneck. This is a hands-on role with broad ownership. In a typical week, you might add a new application to Okta and wire up its provisioning, run a quarterly access review, ship a new device policy in our MDM, close out a control in our compliance platform, draft answers to a client security questionnaire, or flag a new vulnerability to the engineering team and track it to remediation. You don't need to have done all of this before. You need a solid foundation in identity, endpoints, and security fundamentals, the judgment to know what matters, and the drive to own a function at a fast-growing startup. As the company scales, this role grows with it. We expect AI to be part of how you work, not a novelty. You'll have LLM tooling and MCP connections to Vanta and our other systems, and we want you to use them to automate the repetitive parts of IT, security, and compliance so your time goes to judgment calls. You'll also help decide how the rest of the company uses AI safely. Engineering will continue to own secure product development. You'll be the SME in the threat landscape: you'll help set standards, track security developments that affect our stack, coordinate testing, and make sure findings get fixed.

  That seems to combine About Us and The Role. Then Responsibilities:

  Responsibilities

  • Identity and access: Administer Okta: add and configure new applications, manage SSO and MFA, and maintain groups and access policies
  • Own access provisioning and deprovisioning across every system we use, developing sustainable and clear SLAs to support the entire organization
  • Own the employee onboarding and offboarding process, from the first-day laptop to the last-day access removal, and keep it fast, reliable, and auditable
  • Run regular access reviews and make sure least-privilege holds up over time
  • Automate repetitive identity work, such as access requests, provisioning steps, and access review prep, with Okta Workflows, scripting, and AI-assisted tooling
  • Endpoints and IT: Manage our MDM: enrollment, device policies, encryption, patching, and endpoint compliance
  • Maintain an accurate inventory of devices, applications, accounts, and licenses
  • Serve as the first point of contact for employee IT and security questions
  • Security and compliance: Own day-to-day operation of our compliance program: control monitoring, evidence collection, audit preparation, and coordination with auditors
  • Own policy approvals and the annual policy review cycle
  • Administer HIPAA and security awareness training and track completion
  • Create and maintain the processes and policies we need to meet compliance requirements, including incident notification procedures
  • Track security developments, vulnerabilities, and vendor advisories relevant to our stack and drive remediation
  • Client trust: Own responses to client security assessments and questionnaires, and maintain a reusable library of security and compliance answers
  • Support client audits and security reviews as our healthcare partnerships continually expand
  • Secure development partnership: Partner with Engineering on application security standards, dependency and vulnerability scanning, and penetration test coordination
  • Track application security findings through remediation and verify that critical issues are resolved
  • Help engineers adopt new tools with appropriate access, privacy, and data controls
  Qualifications:

  Qualifications

  • 2+ years of experience in corporate IT, systems administration, IT security, security operations, or a related role
  • Hands-on experience with an identity provider (Okta or similar), including SSO, MFA, and user lifecycle management
  • Experience with an MDM platform (Kandji, Jamf, Intune, Mosyle, or similar), ideally in a primarily macOS environment
  • Experience with employee onboarding and offboarding, access provisioning, and access reviews
  • Familiarity with SOC 2 or a similar compliance framework, including how controls, policies, and evidence fit together
  • Working knowledge of security fundamentals: least privilege, endpoint security, vulnerability management, and incident response basics
  • Clear written communication. Much of this job is documenting processes, writing policies, and explaining security to non-technical teammates
  • Fluency with LLM tools (Claude and Gemini) as a normal part of your work, and the judgment to verify their output before you act on it
  • Good judgment when balancing security, usability, and speed
  • Comfort operating within a broad function, learning quickly, and solving problems directly
  • Commitment to work Eastern Timezone hours
  • Must be authorized to work in the U.S. without sponsorship (role not eligible for visa sponsorship)
  Preferred qualifications could be included under Qualifications as a separate subsection maybe with a note. But we could add a

  Preferred Qualifications

  but not in list. Might be okay but risk. Safer to include under Qualifications as a separate

  or

  with label "Preferred". However instruction says use those headings for section headings; but we can still have a

  inside Qualifications that says "Preferred qualifications:" then list. That preserves info. Let's add after required list a

  Preferred qualifications:

  then
  with preferred items. Preferred items: - Experience supporting a SOC 2 audit from readiness through report - Experience with HIPAA or another healthcare compliance requirement - Experience with a compliance automation platform (Vanta, Drata, Secureframe, or similar) - Experience responding to client security questionnaires or enterprise diligence requests - Ability to automate IT and security workflows with scripting, APIs, or modern automation tools - Comfort in a codebase: opening pull requests for security patches and dependency updates - Familiarity with cloud identity and security in AWS, GCP, or Azure - Experience as an early IT or security hire at a growing startup Now Benefits:

  Benefits

  • Robust compensation package inclusive of competitive pay, equity grants, and retirement plan matching
  • Employer-sponsored medical, dental, and vision plans
  We should not include Pay or Schedule sections. Now ensure we removed boilerplate: EEO statement removed. Also removed "All qualified applicants will receive consideration for employment without regard to race, color, religion