Security Analyst

About the role

Metro Vein Centers is hiring a Security Analyst to own and mature our information security program across a 70+ clinic, cloud-first healthcare environment. This is a newly created role that reflects our commitment to proactive security, HIPAA compliance, and a zero trust approach to identity and access management.

Responsibilities

• Monitor security alerts and events across the environment; investigate, triage, and respond to incidents in a timely manner
• Administer and maintain Google Workspace security controls, including DLP policies, Gmail security settings, Drive sharing policies, and audit log review
• Manage endpoint detection and response operations
• Oversee device compliance policies, conditional access rules, and endpoint security baselines
• Administer and enforce MFA policies and password complexity standards across all user populations
• Own and maintain least-privilege access model across enterprise applications and identity platforms
• Manage email security controls including phishing protection, spam filtering, and DMARC/DKIM configuration
• Design and execute phishing simulation campaigns; deliver user security awareness training
• Support HIPAA security compliance, including contributing to risk assessments, policy updates, and audit readiness
• Assist with identity and access management (IAM) administration, including SSO, Google Identity
• Collaborate with the network team on ZTNA policy enforcement and Zscaler security configurations
• Contribute to incident response plans, disaster recovery documentation, and security runbooks
• Track and report on key security KPIs including MFA adoption, device compliance rates, open vulnerabilities, and audit findings
• Occasional travel for critical issues or growth
• Being on call rotation

Requirements

• 3–5 years of experience in an information security, security analyst, or IT security operations role
• Hands-on experience administering Google Workspace security features (admin console, audit logs, DLP, OAuth app controls)
• Experience with endpoint security platforms; CrowdStrike Falcon preferred, Microsoft Defender for Endpoint also considered
• Familiarity with identity and access management concepts: SSO, MFA, RBAC, least privilege
• Solid understanding of email security protocols (SPF, DKIM, DMARC) and email threat landscape
• Working knowledge of HIPAA Security Rule requirements and healthcare data protection obligations

Qualifications

• Strong analytical skills with the ability to investigate alerts and identify indicators of compromise
• Excellent written and verbal communication skills; ability to explain security concepts to non-technical users
• Prior experience in healthcare IT security or compliance roles
• Knowledge of NIST CSF or CIS Controls frameworks

Skills

• CrowdStrike certification (CCFA, CCFH, or equivalent) preferred
• Microsoft security certifications (SC-200, MS-500, or equivalent) a strong plus
• Experience with Zscaler ZIA security policy management or cloud-native security platforms
• Familiarity with SIEM platforms and log management tools
• Experience running security awareness programs and phishing simulations (KnowBe4, Proofpoint, or similar)

Benefits

• Full-time team members are eligible for Medical, Dental, and Vision Insurance
• 401(k) with Company Match
• Generous Paid Time Off (PTO) + Paid Company Holidays
• Company-Paid Life Insurance
• Short-Term & Long-Term Disability Insurance
• Employee Assistance Program (EAP)
• Career Growth & Development Opportunities
• A collaborative, mission-driven culture focused on delivering exceptional patient care

Pay

$75,000 USD - $85,000 USD

Schedule

Full-time