Senior Cyber Security Engineer

Why Wellmark: We are a mutual insurance company owned by our policy holders across Iowa and South Dakota, and we’ve built our reputation on over 80 years’ worth of trust. We are not motivated by profits. We are motivated by the well-being of our friends, family, and neighbors–our members. If you’re passionate about joining an organization working hard to put its members first, to provide best-in-class service, and one that is committed to sustainability and innovation, consider applying today!   

Why Wellmark Technology? Wellmark is building innovative, modern solutions using cutting edge technology. We are driving organizational transformation and business strategy by empowering our technology team to innovate new and elegant solutions to enhance the customer experience. Together, we are leaning into the future, owning the outcome, and driving organizational change to transform how we work. 

We are seeking an experienced security professional to drive complex initiatives that safeguard our organization's sensitive data and critical systems. In this role, you will lead the design and implementation of advanced security protocols and work closely with cross-functional teams to uphold and enforce enterprise-wide security standards. As part of a leading health insurance provider, you will play a key role in protecting member information and ensuring compliance with industry regulations in an ever-evolving threat landscape. 

Required: 

• Bachelor's degree or direct and applicable work experience. 

• Minimum of 7 years of experience working with a variety of technologies within an IT environment. At least 5 years of experience should be within a role where IT security was a primary responsibility. 

• Experience designing and configuring solutions in multiple security domains. 

• Understanding of the OWASP, the MITRE ATT&CK framework, the Cyber Kill Chain, and the software development lifecycle (SDLC). 

• Strong Windows and *nix support skills, network and cyber security knowledge. 

• Extensive knowledge of security technologies, compliance frameworks, and industry best practices. 

• Experience configuring SIEM systems, threat intelligence platforms, SOAR, IDS/IPS, DLP and other networking and system monitoring tools. 

• Experience configuring solutions within a cloud platform (e.g., AWS, Azure, GCP). 

• Experience in scripting languages such as Python, PowerShell, or Bash. 

• Excellent communication skills, both written and verbal, with the ability to explain complex technical issues to non-technical stakeholders. 

• Strong organization skills with the ability to manage multiple tasks simultaneously. 

• Ability to work independently and as part of a team in a fast-paced environment 

• Strong attention to detail with the ability to accomplish tasks and processes accurately and completely. 

• Ability to generate innovative solutions attempting different and novel ways to address problems and opportunities. 

• Proven experience in troubleshooting and performing root cause analysis with the ability to obtain relevant information, identify essential elements, and examine issues or inconsistencies. 

Preferred: 

• Recognized security certifications (e.g., CISSP, OSCP). 

a. Review escalations from junior team members and respond to security events. 

b. Serve as an active member of the Cyber Security Incident Response Team (C-SIRT). Drive the investigation and response to security events and incidents, researching for indicators of compromise, potential data loss, or other abnormal activity. Conduct root cause analysis and implement corrective actions. Provide artifacts where applicable. Complete and maintain documentation throughout the investigation for analysis and reporting. 

c. Guide junior team members on course of action and direction. 

d. Build and configure infrastructure for vulnerability scanning. 

e. Monitor for known exploited vulnerabilities within applications, endpoints, databases, networking, mobile, and cloud services. 

f. Prioritize vulnerability remediation based on criticality, exploitation probability, rating, and business risk exposure. 

g. Collaborate with technical stakeholders to assess and remediate escalated vulnerabilities. 

h. Build and configure infrastructure for host and application hardening scans. Perform scans and recommend remediations. Collaborate with stakeholders to remediate findings. Validate remediations. 

i. Collaborate with stakeholders on the design and rule configuration for network application firewalls, network IPS/IDS, and web application firewalls. Provide technical support and troubleshooting. 

j. Review application scans and determine criticality of findings. Work with application teams to discuss findings and remediation steps. 

k. Design and plan security exercises for team members and guest stakeholders. Responsibly build and oversee the creation of attacks and implement solutions for them to be safely introduced into the environment. 

l. Define key performance indicators and metrics. Gather data to create reporting dashboards. Communicate risks with stakeholders and leadership. 

m. Gather artifacts for audit and compliance reviews. Compile artifacts from junior team members for review. Participate in internal and external audit reviews. 

n. Develop and deliver security awareness materials to educate the workforce about cyber security best practices and the importance of protecting sensitive information. Plan events and coordinate with business stakeholders for execution. Review materials for publication. 

o. Participate in technical and non-technical projects requiring information security oversight to ensure policies, procedures, and standards are met. 

p. Maintain current knowledge of the IT and Cyber Security industry including awareness of new or revised solutions, improved processes, and the development of new attacks and threat vectors. 

q. Advise on best practices and secure implementations for new or existing infrastructure, tools, etc. Recommend new security solutions as well as effective improvements to the existing security controls that do not negatively impact business innovation. 

r. Serve as a liaison for the security team collaborating with business and technical stakeholders. 

s. Perform ad-hoc penetration tests on Wellmark systems and applications and report found issues to leadership. 

t. Other duties as assigned. 

All your information will be kept confidential according to EEO guidelines.

Remote Eligible: You will have the flexibility to work where you are most productive. This position is eligible to work fully remote. Depending on your location, you may still have the option to come into a Wellmark office if you wish to. Your leader may ask you to come into the office occasionally for specific meetings or other ‘moments that matter’ as well.  

An Equal Opportunity Employer

The policy of Wellmark Blue Cross Blue Shield is to recruit, hire, train and promote individuals in all job classifications without regard to race, color, religion, sex, national origin, age, veteran status, disability, sexual orientation, gender identity or any other characteristic protected by law.

Applicants requiring a reasonable accommodation due to a disability at any stage of the employment application process should contact us at [email protected]

Please inform us if you meet the definition of a "Covered DoD official".