Sr. Cyber Security Engineer, Security Validation

Job Summary

Community Health Systems is one of the nation’s leading healthcare providers. Developing and operating healthcare delivery systems in 47 distinct markets across 16 states, CHS is committed to helping people get well and live healthier. CHS affiliates operate 70+ acute-care hospitals and more than 1,000 other sites of care, including physician practices, urgent care centers, freestanding emergency departments, occupational medicine clinics, imaging centers, cancer centers and ambulatory surgery centers.

As a Senior Cybersecurity Engineer in the Security Validation team, you will be a key member of our Red Team operations, assist in efforts to emulate real-world threat scenarios and validate the effectiveness of enterprise defenses across our expansive healthcare environment. This role requires advanced offensive security capabilities, deep knowledge of adversary tactics, and the ability to communicate findings clearly to both technical and executive stakeholders. You will design and execute advanced threat simulations against our infrastructure—cloud, clinical systems, APIs, IoT medical devices, and enterprise platforms—helping CHS proactively identify and mitigate systemic weaknesses. You will also work with internal teams and third parties to provide feedback on the relevance of vulnerabilities to CHS systems, ensuring alignment between threat findings and risk remediation efforts. Your work will directly impact patient safety, data integrity, and regulatory compliance across a network of hospitals and clinics.

Essential Functions

• Red Team engagements emulating real-world threat actors, including APTs and insider threats, aligned with MITRE ATT&CK.
• Conduct Security Validation Exercises across cloud, on-prem, hybrid, and medical environments to measure resilience against defined threat scenarios.
• Develop and maintain custom tools, exploits, and payloads to simulate evolving adversarial behavior.
• Collaborate with Blue Teams to refine detections, validate logging, and improve response capabilities.
• Identify and characterize security risks in critical systems such as EMRs, PACS, medical IoT, and enterprise SaaS platforms.
• Produce detailed reports and executive summaries, translating technical findings into actionable mitigation strategies.
• Design tabletop and live-fire exercises that evaluate organizational readiness, incident response workflows, and security control efficacy.
• Work with the threat intelligence team specific to the healthcare industry intelligence and adjust validation activities accordingly.
• Enrich threat hunting with current IoC’s and TTP’s to identify vulnerabilities and gaps in monitoring across the CHS enterprise.
• Ensure Red Team operations follow defined rules of engagement, safeguarding patient care and system availability.
• Participate in compliance-driven assessments (e.g., HIPAA Security Rule, HITRUST) by providing validation evidence and attack simulations.
• Mentor junior staff and foster a culture of offensive security awareness and continuous improvement.

Qualifications

• Bachelor's Degree in Cyber Security, Computer Science, Information Technology, or a related field; or the equivalent required
• 5-7 years of experience in cybersecurity, information technology operations, or a related field required
• 3+ years in offensive security or Red Team roles preferred

Knowledge, Skills and Abilities

• Proven experience performing Red Team or Purple Team engagements in large enterprise environments
• Expertise in security validation, threat modeling, and adversary simulation
• Demonstrated experience in regulated environments—healthcare industry experience highly preferred
• Hands-on proficiency with tools such as Cobalt Strike, Metasploit, BloodHound, Covenant, Caldera, or similar
• Familiarity with security challenges in cloud platforms (Azure/AWS/GCP), medical IoT, and EHR/EMR systems
• Competencies:• Deep understanding of attack lifecycle, threat emulation frameworks, and operational security

Strong written and verbal communication skills—ability to brief executive leadership

Licenses and Certifications

• Relevant security certifications (e.g., CISSP, GIAC, or OSCP) preferred
• PNPT, OSCP, OSCE, CRTO, GXPN, or GPEN
• CISSP is a plus when paired with offensive security certs