IT Systems Engineer Sr Application Security

Ann & Robert H. Lurie Childrens Hospital of Chicago provides superior pediatric care in a setting that offers the latest benefits and innovations in medical technology research and family-friendly design. As the largest pediatric provider in the region with a 140-year legacy of excellence kids and their families are at the center of all we do. Ann & Robert H. Lurie Childrens Hospital of Chicago is ranked in all 10 specialties by the U.S. News & World Report.

The Application Security Engineer is a handson technical role responsible for implementing validating and maintaining security controls across all tiers of the hospitals application stack including database middleware web server API and presentation layers. The engineer ensures applications integrations and supporting components are securely configured monitored and aligned with enterprise security standards.

This role works directly with infrastructure vulnerability management and vendors to identify remediate and prevent applicationlayer risks. The engineer performs handson validation troubleshooting and configuration enforcement to ensure securebydefault application deployments across the enterprise.

Essential Job Functions:

• Serve as the central authority for application and integration risk by applying consistent security standards across a portfolio of more than 250 commercial and thirdparty applications.

• Identify and reduce applicationlayer risk across thirdparty applications APIs system integrations automated file transfers and service accounts.

• Interface with application vendors application owners and other departments as needed.

• Assess and secure internetfacing applications by identifying exposed access points and prioritizing remediation of highrisk entry vectors.

• Enforce standardized security controls for authentication authorization credential and secret management encryption and secure communication patterns.

• Partner with application owners and vendors to eliminate insecure configurations excessive access credential misuse and other security issues.

• Evaluate and secure applications throughout their lifecycle including procurement implementation integration and ongoing operations.

• Support thirdparty risk management by assessing vendor integrations data flow methods and exposure points.

• Drive remediation of application vulnerabilities identified through vulnerability scanning (e.g. Qualys) configuration reviews and security testing of externally facing systems.

• Improve visibility and governance over application security posture by tracking exposure trends risk reduction and remediation progress.

Knowledge Skills and Abilities:

• Strong understanding of applicationlayer attack paths including credential compromise integration abuse API exploitation and external exposure risks.

• Deep knowledge of authentication and authorization models such as SSO OAuth service accounts and secure integration patterns.

• Expertise in encryption and data protection across application and integration workflows.

• Experience in complex enterprise environments with large commercial application portfolios.

• Strong familiarity with OWASP Top 10 common exploitation techniques IAM concepts and secrets/credential lifecycle management.

• Knowledge of CIS Controls and Benchmarks as they apply to application security.

• Experience with vulnerability scanning and testing tools such as Qualys Qualys WAS Metasploit SAST/DAST and configuration/exposure analysis tools.

• Understanding of network and edge security including WAFs firewalls segmentation and internetfacing exposure.

• Ability to drive crossfunctional remediation across technical and nontechnical stakeholders.

• Strong analytical and prioritization skills in a riskbased environment.

• Excellent communication skills with the ability to translate technical risk into business impact.

Education and Experience

• Bachelors Degree in Computer Science Information Security Information Systems or related field or equivalent work experience.

• 37 years of experience in application security cybersecurity or enterprise application support.

• Experience working in large enterprise environments with multiple commercial applications and integrations preferred.

• Experience within a healthcare provider environment is desirable.

• Security certifications such as CISSP CSSLP GWAPT CASE CEH OSCP or equivalent are beneficial but not required.

Education

Pay Range

At Lurie Childrens we are committed to competitive and fair compensation aligned with market rates and internal equity reflecting individual contributions experience and expertise. The pay range for this job indicates minimum and maximum targets for the position. Ranges are regularly reviewed to stay aligned with market conditions.In addition to base salary Lurie Childrens offer a comprehensive rewards package that may include differentials for some hourly employees leadership incentivesfor select roles health and retirement benefits and wellbeing programs. For more details on other compensation consult your recruiter or click the followinglink to learn more about our benefits.

Benefit Statement

For full time and part time employees who work 20 or more hours per week we offer a generous benefits package that includes:

Medical dental and vision insurance

Employer paid group term life and disability

Employer contribution toward Health Savings Account

Flexible Spending Accounts

Paid Time Off (PTO) Paid Holidays and Paid Parental Leave

403(b) with a 5% employer match

Various voluntary benefits:

• Supplemental Life AD&D and Disability
• Critical Illness Accident and Hospital Indemnity coverage
• Tuition assistance
• Student loan servicing and support
• Adoption benefits
• Backup Childcare and Eldercare
• Employee Assistance Program and other specialized behavioral health services and resources for employees and family members
• Discount on services at Lurie Childrens facilities
• Discount purchasing program

Theres a Place for You with Us

At Ann & Robert H. Lurie Childrens Hospital of Chicago and its affiliates (collectively Lurie Childrens) we embrace and celebrate diversity and equity in a serious way. We are committed to building a team with a variety of backgrounds skills and viewpoints recognizing that diverse identities strengthen our workplace and the care we can provide to the Chicago community and beyond. We treat everyone fairly appreciate differences and make meaningful connections that foster belonging and is a place where you can be your best so we can give our best to the patients and families who trust us with their care.

Lurie Childrens and its affiliates are equal employment opportunity employers. We value diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race color sex sexual orientation gender identity or expression religion national origin ancestry age disability marital status pregnancy protected veteran status order of protection status protected genetic information or any other characteristic protected by law.

For questions about how to request an accommodation please contact:

AI Notice

Lurie Childrens utilizes certain AI-enabled features within our recruiting platform to support candidate engagement and assist recruiters in identifying and prioritizing applicants whose experience aligns with job requirements. All employment decisions are made by individuals.

It is a civil rights violation with respect to recruitment hiring promotion or employment for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of protected classes under the Illinois Human Rights Act or to use zip codes as a proxy for protected classes.

For questions about the use of artificial intelligence in this process or any additional support please contact: