Senior Corporate IT Security Engineer

We Breathe Life Into Data

At Komodo Health, our mission is to reduce the global burden of disease. And we believe that smarter use of data is essential to this mission. That’s why we built the Healthcare Map — the industry’s largest, most complete, precise view of the U.S. healthcare system — by combining de-identified, real-world patient data with innovative algorithms and decades of clinical experience. The Healthcare Map serves as our foundation for a powerful suite of software applications, helping us answer healthcare’s most complex questions for our partners. Across the healthcare ecosystem, we’re helping our clients unlock critical insights to track detailed patient behaviors and treatment patterns, identify gaps in care, address unmet patient needs, and reduce the global burden of disease.

As we pursue these goals, it remains essential to us that we stay grounded in our values: be awesome, seek growth, deliver “wow,” and enjoy the ride. At Komodo, you will be joining a team of ambitious, supportive Dragons with diverse backgrounds but a shared passion to deliver on our mission to reduce the burden of disease — and enjoy the journey along the way.

The Opportunity at Komodo Health

You will engineer and run Corporate IT Security at Komodo Health, protecting the employee environment across identity, devices, endpoints, internal networks, workforce SaaS and AI tools, and workforce-related risk. Komodo works with sensitive healthcare data, so getting corporate security right matters to our customers.

This role sits in IT and works closely with the Security team, which owns security monitoring, cloud and production security, and the company incident response program. You will lead incidents in the corporate environment under that program and act as IT’s security partner for Legal, Compliance and business leaders.

This is a senior individual contributor role, and you will not manage a team. Expect at least 70% of your time to be hands-on: configuring, scripting, investigating and remediating. The rest goes to corporate incident response, documentation and cross-functional partnership.

Looking back on your first 12 months at Komodo Health, you will have…

• First 90 days: a current-state assessment of corporate identity, devices and SaaS, delivered as a sequenced remediation backlog with named owners. The highest-risk exposures are addressed first.
• Access to business-critical applications is tied to device posture, and privileged access consistently uses phishing-resistant MFA.
• Applications are provisioned and deprovisioned through the identity provider. Offboarding SLAs are measured and met, and access reviews complete on schedule with clean evidence.
• Workforce SaaS applications have least-privilege export and API rights, session protections and a governed OAuth and connected-app inventory, and corporate secrets are kept out of SaaS and collaboration tools.
• New identity, endpoint and SaaS-abuse detection use cases are delivered with Security, and corporate alerts routed to IT have a defined owner and response.
• At least two tabletop exercises have run with IT, Security, Legal and Communications, and every corporate incident closes with a post-incident review whose follow-ups are tracked to completion.
• Governance for shadow IT, risky OAuth grants and workforce AI adoption is in place, and it enables the business rather than slowing it down.

You will accomplish these outcomes through the following responsibilities…

• Identity and access hardening in our enterprise identity provider and productivity suite: phishing-resistant MFA, consistent SSO enforcement, session and sign-on policies, least-privilege admin roles, and governance of service and non-human accounts.
• Device trust and conditional access: use device-posture tooling with our MDM and EDR across a mixed macOS and Windows fleet, so access to business systems depends on device health.
• Joiner-mover-leaver integrity: every app provisioned through the identity provider with no out-of-band accounts, timely and verified deprovisioning, offboarding exceptions tracked to closure, and access reviews that hold up in an audit.
• Workforce SaaS security posture: data export and API access controls, session protections, OAuth and connected-app governance, audit-log monitoring, and detection of shadow IT and configuration drift.
• Corporate incident response: act as Incident Commander for incidents limited to the corporate environment, under the company incident response process, which sets severity and keeps the incident record. Security leads once production, cloud or customer data is involved, and you support those incidents with IT expertise. Coordinate IT, Legal, Compliance and Communications, drive investigation and remediation, and run blameless post-incident reviews with follow-ups tracked to completion.

…