Information Security Analyst - Security Operations & Platforms

Who we are:

Third Way Health helps medical practices across the United States improve the patient experience while reducing the administrative burden on practice owners. We enable practices to enhance the experience of their patients by providing them with a leading service automation platform and a world class team of service representatives. What unites us is our passion to support physicians and provide better access for patients from all backgrounds.

About the position:
This role keeps TWH's security platforms configured, covered and healthy, and acts on what they detect. It is an operational role: you apply the platform baselines and standards, and you are the first responder to security alerts, using automation and integrations to do it at scale.

As a healthcare organization under HIPAA and SOC 2 Type II, TWH needs alerts handled consistently and evidenced.

Key responsibilities

Security platform administration

• Apply policies and maintain configuration, coverage and health of the EDR, data-loss prevention (DLP), MDM, and vulnerability-management platforms, keeping them consistent across countries.
• Oversee network security devices (firewalls, switches): accountable for secure configuration while vendors execute approved changes.
• Provide technical L2 support for security-platform issues that L1 cannot resolve.

Alert triage and handling

• Triage alerts and detections from all security platforms: classify, enrich and prioritize by severity and business impact.
• Investigate and resolve or contain confirmed alerts using agreed playbooks, and help write and maintain those playbooks with the Information Security Lead; document every outcome.
• Tune detections and rules to reduce false positives and close coverage gaps.
• Escalate major incidents to the Information Security Lead.
• Uses approved AI tools to support alert triage, investigation, documentation and automation, applying the same security and data-handling standards as any other system.
• Use approved AI tools to support triage and investigation, with human validation of every decision.

Automation and integrations

• Integrate security platforms with each other and with the ticketing system (APIs, webhooks, scripting) so alerts reach one consistent workflow.
• Automate enrichment, routing and repetitive response actions; document and maintain each automation.
• Uses approved AI tools to support alert triage, investigation, documentation and automation, applying the same security and data-handling standards as any other system.

Identity, access and audit support

• Administer and monitor the identity platform (Google Workspace) as one of the security platforms, applying the security and conditional-access settings defined by the Information Security Lead.
• Provision and remove vendor access (least-privilege, time-bound, logged) according to the established standard, and execute periodic access reviews.
• Track vulnerability remediation and collect alert, access-review and posture evidence to support SOC 2 Type II and HIPAA audits.

Requirements

• Degree in Systems, Computer or a related field, or equivalent experience.
• 3-5 years in IT security, at least 2 of them in security operations (handling alerts or operating security tooling).
• Hands-on administration of at least two of: EDR, DLP, vulnerability management or MDM.
• Alert triage and investigation: log analysis and incident-response fundamentals.
• Basic scripting (Python or equivalent) to automate repetitive tasks.
• Identity and access fundamentals: Google Workspace administration, least privilege, access reviews.
• Firewall and network security basics.
• Ticketing tools and security reporting.
• Familiarity with HIPAA safeguards and SOC 2 controls.

Soft skills

• Documents every alert decision so another analyst can repeat it.
• Prioritizes by risk and business impact when several alerts compete, and explains the reasoning.
• Works strictly within assigned permissions when handling sensitive data and privileged access, and reports own mistakes promptly.
• Spots repetitive tasks and proposes or builds an automation for them.
• Communicates clearly in Spanish and English with service providers and stakeholders in several countries, and asks for clarification when instructions are ambiguous.

Nice to have

• Experience in a regulated environment (healthcare / HIPAA, SOC 2, PCI or similar).
• Security+, CySA+ or ISO 27001 foundation certification, or similar.
• Google Workspace Administrator certification.
• Experience building API/webhook integrations between security tools and ticketing systems, or low-code workflow automation.