This is a full-time remote position within the United States. Employees located in the Nashville, TN area have the option to work from the Nashville office.
Responsibilities
Design, provision, and operate Azure infrastructure—including App Service, AKS, Functions, networking, storage, and databases—using Terraform or Bicep with disciplined module design, state management, and peer review.
Build and maintain CI/CD pipelines in Azure DevOps for secure, repeatable infrastructure and application deployments with appropriate change management.
Automate routine operational tasks and workflows using PowerShell, Bash, or Python.
Own the platform and infrastructure controls that support OneOncology’s HITRUST CSF certification, partnering with Security and Compliance on scoping, readiness, remediation, and assessment.
Build and maintain secure configuration baselines, reusable infrastructure modules, and automated control monitoring and evidence collection using tools such as Azure Policy and Microsoft Defender for Cloud.
Extend controls and tooling to newly acquired practices and environments as OneOncology grows.
Administer identity and access controls through Microsoft Entra ID, RBAC, Privileged Identity Management, Conditional Access, and MFA, including access reviews and enforcement of least-privilege and segregation-of-duties principles.
Manage secrets, certificates, and encryption keys in Azure Key Vault, including rotation and lifecycle management.
Maintain centralized logging, monitoring, detections, alerts, and dashboards using Azure Monitor, Log Analytics, and Microsoft Sentinel, with appropriate audit retention and immutability requirements. Participate in incident response and the on-call rotation.
Run authenticated vulnerability scanning and drive risk-based remediation within agreed SLAs.
Manage patching across cloud and server workloads with minimal disruption.
Maintain backup and disaster recovery capabilities and test recovery against defined RTO and RPO targets.
Develop self-service tooling, templates, runbooks, and documentation that enable application engineers to move quickly within established security and compliance guardrails
Additional responsibilities as assigned to help drive our mission of improving the lives of everyone living with cancer.
Qualifications
Required
Bachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent work experience.
High school diploma or GED.
5+ years of experience in platform, infrastructure, DevOps, cloud, or site reliability engineering.
3+ years of hands-on Microsoft Azure experience across compute, networking, identity, storage, and monitoring.
Demonstrated experience with Infrastructure as Code (Terraform, Bicep, or ARM templates), including module design and state management.
Experience designing and maintaining CI/CD pipelines, ideally in Azure DevOps or GitHub Actions.
Strong scripting skills in PowerShell, Bash, or Python.
Working knowledge of at least one healthcare or security compliance framework — HITRUST CSF, HIPAA/HITECH, SOC 2, or NIST — and practical experience enforcing those controls in a cloud environment.
Comfort operating autonomously on a small team and owning problems end to end.
Preferred
Direct experience supporting a HITRUST CSF validated assessment (e1, i1, or r2) or an equivalent audit, including evidence preparation.
Experience in healthcare technology or another HIPAA-regulated environment.
Kubernetes / AKS and container security experience.
SIEM experience (Microsoft Sentinel) and familiarity with compliance automation tooling such as MyCSF, Vanta, or Drata.
Certifications such as AZ-104, AZ-400, AZ-500, CKA/CKS, CISSP, or HITRUST CCSFP.
Familiarity with AI-assisted engineering tools and how to adopt them safely in a regulated environment.
Essential Competencies
Autonomy and ownership — able to take an ambiguous problem from design through production with limited oversight.
Architectural judgment — designs systems, not just features, and can explain the tradeoffs behind a decision.
Clear written and verbal communication with both technical and non-technical partners.
Generalist range and comfort operating on a small, fast-moving engineering team.
Sound handling of protected health information and a security-first mindset.
Attendance is an essential job function.
