Lead Security Engineer (Hybrid)

When you’re the best, we’re the best. We instill an environment where employees feel engaged, satisfied and able to contribute their unique skills and talents while living and working as their authentic selves. We provide extensive opportunities for personal and professional development, building both employee competence and organizational capability to fuel exceptional performance through an inclusive environment both now and in the future.

We are seeking an experienced Lead Security Engineer to serve as a dedicated security engineering partner supporting the VIP program. This position will work closely with software engineering, product development, enterprise architecture, and infrastructure teams to ensure security is incorporated throughout the entire technology development lifecycle.

This role will require working in the Irving, TX office 3 days per week.

An in-person interview required.

The ideal candidate brings deep technical expertise across application security, cloud security, secure software development, and emerging artificial intelligence technologies. This individual will play a critical role in translating enterprise security requirements into practical technical solutions, identifying security risks early in the development process, and ensuring appropriate security controls are implemented and validated before production deployment.

The Lead Security Engineer will also serve as a technical subject matter expert for AI-enabled applications and architectures, including large language models (LLMs), AI agents, retrieval-augmented generation (RAG), and integrations with enterprise systems and data.

This is a highly collaborative, hands-on technical leadership position requiring the ability to work independently, influence technical decisions, and establish effective partnerships across Security, Engineering, and Enterprise Architecture.

Key Responsibilities

Security Engineering and Architecture

• Serve as the primary technical security partner for the VIP program, providing security engineering expertise throughout discovery, design, development, testing, and deployment.
• Collaborate with software engineers, architects, and infrastructure teams to incorporate security requirements into applications, APIs, cloud services, and supporting infrastructure.
• Conduct security architecture and design reviews to identify vulnerabilities, architectural weaknesses, and potential security risks.
• Lead threat modeling activities to identify attack surfaces, trust boundaries, potential threats, and appropriate security controls.
• Translate enterprise security policies, standards, and requirements into actionable technical implementation guidance.
• Review proposed architectures and technical solutions to ensure alignment with enterprise security requirements and secure-by-design principles.
• Identify gaps in existing security standards and develop recommendations for new or updated technical security controls, guardrails, and reference architectures.

Artificial Intelligence Security

• Serve as a technical security subject matter expert for AI-enabled applications and solutions developed within the VIP program.
• Evaluate the security of AI architectures, including LLM integrations, autonomous AI agents, RAG implementations, and model-to-application integrations.
• Identify and assess AI-specific security threats, including prompt injection, sensitive information disclosure, insecure tool integrations, excessive agency, and unauthorized data access.
• Partner with engineering teams to establish secure implementation patterns for AI applications, including identity, authentication, authorization, data protection, and monitoring.
• Review AI application designs to identify potential security weaknesses and recommend appropriate mitigating controls.
• Evaluate emerging AI security risks and recommend improvements to enterprise security standards and engineering practices.
• Support the development of reusable security guardrails for AI applications and integrations.

Application Security and Secure Development

• Integrate security considerations throughout the software development lifecycle (SDLC).
• Provide technical guidance on secure coding practices, dependency management, secrets management, API security, and application authentication and authorization.
• Collaborate with Application Security teams to review vulnerability findings and determine appropriate remediation approaches.
• Support the evaluation and interpretation of static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA) findings.
• Review application security risks associated with third-party libraries, open-source dependencies, and software supply chain components.
• Provide security guidance for CI/CD pipelines, infrastructure as code (IaC), and automated deployment processes.
• Work with development teams to ensure identified security vulnerabilities and control deficiencies are appropriately addressed before production deployment.

Cloud and Infrastructure Security

• Evaluate security controls across cloud-based architectures and supporting infrastructure.
• Provide technical guidance on cloud identity, access management, network segmentation, encryption, secrets management, and secure configuration.
• Review cloud application architectures for compliance with established enterprise security requirements.
• Assess security implications associated with infrastructure automation, containerized workloads, and cloud-native services.
• Collaborate with Cloud Operations and Infrastructure teams to validate the implementation of required security controls.
• Identify opportunities to strengthen cloud security through reusable configurations, security patterns, and automated guardrails.

Security Standards and Risk Management

• Identify gaps in enterprise security standards and develop proposed technical requirements, implementation guidance, and security guardrails.
• Collaborate with Enterprise Security, Enterprise Architecture, and Engineering stakeholders to review and align proposed security standards.
• Conduct technical security risk assessments for applications, architectures, and emerging technologies.
• Document identified security risks, recommended remediation actions, and compensating controls.
• Coordinate with Governance, Risk, and Compliance (GRC) teams when formal risk acceptance or security exceptions are required.
• Provide technical recommendations to support informed security risk decisions.
• Ensure security decisions and implementation requirements are appropriately documented.

Security Validation and Cross-Functional Collaboration

• Validate the implementation of security controls and agreed remediation actions throughout the development lifecycle.
• Partner with Application Security, Security Operations, Identity and Access Management, Cloud Security, and other specialized security teams.
• Participate in technical discussions to resolve security concerns and provide practical, risk-informed recommendations.
• Coordinate security testing and validation activities with appropriate technical stakeholders.
• Identify opportunities to improve security engineering processes, technical standards, and development practices.
• Communicate complex technical security concepts clearly to engineering teams, architects, product owners, and leadership.

Required Qualifications

• 8+ years of experience in information security engineering, application security, cloud security, or related technical security disciplines.
• Demonstrated experience working with software engineering and architecture teams to implement security requirements.
• Strong understanding of secure software development practices, application security vulnerabilities, and common attack techniques.
• Experience performing security architecture reviews, threat modeling, and technical security risk assessments.
• Strong knowledge of authentication, authorization, identity management, encryption, secrets management, and API security.
• Experience securing cloud-based applications and infrastructure.
• Familiarity with CI/CD pipelines, DevSecOps practices, and infrastructure as code.
• Understanding of modern AI architectures and associated security risks, including LLMs, AI agents, RAG, and enterprise AI integrations.
• Experience interpreting security assessment results and providing actionable remediation guidance.
• Ability to develop technical security standards, reference architectures, and implementation guidance.
• Strong analytical, problem-solving, and technical communication skills.
• Ability to work independently and influence technical decisions across multiple teams.
• Experience with Security Architecture Reviews and Vulnerability Management

Preferences

• PowerShell, Python, Okta, Entra ID, Splunk, SIEM
• Ability to review and read code

Estimated Hiring Range:

This position is also incentive eligible.

Vizient has a comprehensive benefits plan! Please view our benefits here:

http://www.vizientinc.com/about-us/careers

Equal Opportunity Employer: Females/Minorities/Veterans/Individuals with Disabilities

The Company is committed to equal employment opportunity to all employees and applicants without regard to race, religion, color, gender identity, ethnicity, age, national origin, sexual orientation, disability status, veteran status or any other category protected by applicable law.

About Us

Working at Vizient means shaping the future of healthcare, every day.

Alongside our clients, we're building a healthier, more human healthcare system. We connect people, data, and solutions to enable healthcare organizations to improve financial sustainability, enhance system performance, and deliver better care.

Headquartered in Irving, Texas, with 11 offices across the United States, Vizient has more than 5,000 employees who bring deep expertise and a shared commitment to transforming healthcare. Together, we're solving some of the industry's most complex challenges while creating opportunities to learn, grow, and drive lasting change for healthcare organizations and the communities they serve.

Through our enterprise of companies, we deliver meaningful impact across the continuum of care:

• Apexus - The exclusive contractor for 340B Drug Pricing Program, managed by the Health Resources and Services Administration.
• aptitude - The industry's first online direct contracting market, supporting self-contracting activity between hospitals and suppliers.
• Kaufman Hall - Leading healthcare advisory services to support our clients in achieving financial, clinical, and operational excellence.
• Provista - Proven supply chain partner specializing in extended, diagnostic, and preventive care facilities, including surgery centers, home health, and senior living.

Click here for Vizient Careers Home Page.