Back to jobs

Cybersecurity Engineer

Cambridge, Massachusetts, United States

Iterative Health is a healthcare technology and services company powering the acceleration of clinical research to transform patient outcomes.

We built a leading performance-driven network of 100+ sites across the US, Europe, India, and Australia, conducting research directly in the communities where care is delivered across gastrointestinal, hepatology, obesity, and cardiology. By combining deep clinical trial expertise with cutting-edge AI, we connect sponsors' scientific ambitions with high-performing research teams that expedite and expand access to novel therapeutics for patients in need. Today, Iterative Health is headquartered in Cambridge, Massachusetts, and New York City with 250+ employees world-wide.

 

As Iterative Health's first dedicated cybersecurity hire, you won't be stepping into an existing security program—you'll be building it. This is a rare opportunity to establish and lead the company's cybersecurity strategy, creating the foundation that will protect our people, technology, data, and business as we continue to scale.

In this role, you'll own the end-to-end security landscape, including our AWS cloud infrastructure, identity and access management, SaaS ecosystem, endpoint security, sensitive clinical and patient data, and the security and compliance frameworks that support our business. You'll work cross-functionally with IT, Engineering, Compliance, Legal, and business leaders to strengthen our security posture, reduce organizational risk, and embed security into every aspect of the company.

We're looking for a hands-on security leader who combines deep technical expertise with strong business judgment and a builder's mindset. You'll be equally comfortable architecting security solutions, responding to evolving threats, developing policies and controls, and influencing stakeholders across the organization. This is an opportunity to create a scalable, modern security program that grows alongside a fast-paced healthcare technology company.

 

Where You’ll Drive Impact 

Security Program Development

  • Serve as Iterative Health's first dedicated cybersecurity resource — build, mature, and operate the company's security program from the ground up.
  • Identify security gaps, prioritize remediation, and partner with the IT Director to define security priorities, roadmap items, and risk reduction plans.
  • Develop, maintain, and enforce security policies, standards, procedures, runbooks, and control documentation.
  • Provide company-wide subject matter expertise and support related to cybersecurity awareness and compliance.

Cloud & Infrastructure Security

  • Work with engineering team to secure and monitor AWS environments, including IAM, logging, encryption, backups, access controls, and overall cloud security posture.
  • Configure firewalls, encryption, and access controls across cloud and corporate infrastructure.
  • Improve security controls across Okta, Entra ID, Microsoft 365, Google Workspace, Box, SharePoint, AWS, and other cloud platforms.

Identity & Access Governance

  • Maintain and improve RBAC, access reviews, privileged access controls, admin role governance, service account oversight, and joiner/mover/leaver security processes.

Incident Response

  • Own incident response for suspected cyberattacks, account compromise, malware, data exposure, unauthorized access, and other security events.
  • Lead incident investigation, containment, remediation, documentation, root-cause analysis, and post-incident improvement tracking.

Compliance & Risk Management

  • Own security evidence collection, control documentation, remediation tracking, and audit support for SOC 2, HIPAA/HITECH, and applicable GDPR requirements.
  • Own all vendor assessment and security questionnaire responses.
  • Support vulnerability management, penetration testing, social engineering testing, customer security reviews, vendor security questionnaires, third-party risk assessments, security awareness, and user education.
  • Performs related duties as requested 

What You Bring to the Team

  • Bachelor's degree in IT, engineering, mathematics, or a related field; candidates with extensive cybersecurity certification in lieu of a degree will be considered.
  • 5+ years of experience in cybersecurity, security engineering, cloud security, IT security, or a related technical security role.
  • Strong working knowledge of HIPAA, HITECH, SOC 2, and HITRUST frameworks.
  • Hands-on experience with AWS, Microsoft 365, and Google Workspace security tooling.
  • Experience with Bitdefender, Microsoft Defender, Intune, Entra ID, Microsoft Purview, Google Workspace security, Okta, or SIEM/logging tools.
  • Strong documentation skills, including policy and procedure writing.
  • Ability to communicate effectively with non-technical business partners.
  • Experience with PowerShell, Python, APIs, or security workflow automation.
  • Experience with vulnerability management, penetration test remediation, phishing simulation programs, or third-party risk reviews.

Preferred Qualifications

  • Knowledge of EU General Data Protection Regulation (GDPR).
  • One or more relevant certifications, including but not limited to: CompTIA Security+, CySA+, or Pen Test+; GCIH; ISC2 CCSP; AWS Certified Security Specialty (SCS-C03); Microsoft SC-200, SC-300, SC-401, SC-100, or SC-900; Google Cybersecurity Professional or Cloud Cybersecurity Certificate.
  • Experience building or maturing a security program in a high-growth or startup environment.
  • Background in healthcare technology, clinical research, or other highly regulated industries.

 

How We Work 

  • Collaborative and low-ego team environment
  • High ownership and accountability culture
  • Fast-paced and highly iterative growth environment
  • Open communication and continuous learning mindset
  • Mission-driven organization focused on improving patient outcomes
  • Comfortable navigating evolving business priorities and opportunities




Benefits That Support You 

We believe great teams do their best work when they feel supported — professionally and personally.

  • Hybrid work environment with in-office collaboration two days per week in either our NYC or Boston office
  • Comprehensive medical, dental, and vision coverage, with up to 80% of premiums covered by Iterative Health
  • Mental health and wellness support through Spring Health
  • Health HSA or FSA options, and commuter FSA contributions supported by Iterative Health
  • Unlimited PTO, 12 company holidays, and a company-wide shutdown between Christmas and New Years
  • 401(k) program with a company match of up to 3% (up to $3,000 annually)
  • Weekly in-office lunch benefit every Tuesday
  • 100% company-paid short-term and long-term disability coverage
  • Annual wellness and professional development stipend to support your health and growth
  • And more!



At Iterative Health, we’re actively working towards creating an environment that is representative of the diversity of patients our technology serves. We are focused on building an equitable and inclusive culture, and by extension, hiring process. If you require any accommodations to make the application process or interviewing experience more accessible to you, please contact CandidateAccommodations@iterative.health.

Create a Job Alert

Interested in building your career at Iterative Health? Get future opportunities sent straight to your email.

Apply for this job

*

indicates a required field

Resume/CV*

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf

Select...
Select...
Select...

 

Please read the following statement carefully and please type your full name above to agree to this statement.

By providing your electronic name, you acknowledge that you have read and understand this statement. DO NOT AGREE UNTIL YOU HAVE READ THE BELOW STATEMENT IN FULL. 

Equal Employment Opportunity Statement

Iterative Health (the “Company”) is proud to be an equal opportunity employer, and is committed to providing equal employment opportunities to all employees and applicants without regard to actual and/or perceived: race; color; national origin; religion; age; sex (including pregnancy, childbirth, breastfeeding, and related medical conditions); gender identity or expression (including transgender status); affectional or sexual orientation; disability (mental and physical); atypical hereditary cellular or blood trait or genetic information (including family medical history); uniform service member and veteran status; participation in legally protected conduct or making a complaint relating to unlawful conduct; and any other characteristic or conduct protected by applicable federal, state, or local law.

Applicant’s Statement 

     I certify that the answers given to the questions and the statements made (including statements on the attached resume, and inserted forms, if any) on this application and in the hiring process are true. I understand that a false statement, a false answer, an omission, or a misleading statement may result in a decision not to hire me, the withdrawal of any offer of employment, or the termination of my employment with Company regardless of when such false, misleading, or erroneous information is discovered.

     I understand that if hired, unless I am employed under a specific written contract or collective bargaining agreement, my employment will be "at will" and that my employment may be terminated at any time with or without cause and with or without notice. I understand that no representative of the Company has any authority to make any assurances, representations or promises contrary to the "at-will" nature of my employment unless it is in writing signed by an authorized officer of Iterative Health. I understand that I may terminate my employment with or without cause and with or without notice at any time. I further agree that Company reserves the right to make unilateral changes to the terms and conditions of my employment.

 

     I authorize Company to investigate my references and communicate with my former employers concerning my employment unless specifically stated otherwise in this application. I authorize all individuals, schools, and employers named, and all financial institutions, law enforcement agencies, and all persons except as specifically limited on this application to provide information requested about me, and I promise I will not bring any legal claims or actions against my current or former employers due to their responses to any job reference request.

     I further understand that the completion of an application is a preliminary step to employment. It does not obligate Company to offer employment to me, or for me to accept employment. I further acknowledge that if offered employment, any offer of employment may be a conditional offer of employment pending successful completion of a drug screening and/or background check. Any consideration of the background check will be tailored to the requirements of the job.

 

FOR MARYLAND APPLICANTS: UNDER MARYLAND LAW, AN EMPLOYER MAY NOT REQUIRE OR DEMAND, AS A CONDITION OF EMPLOYMENT, PROSPECTIVE EMPLOYMENT OR CONTINUED EMPLOYMENT, THAT AN INDIVIDUAL SUBMIT TO OR TAKE A LIE DETECTOR OR SIMILAR TEST. EMPLOYER WHO VIOLATES THIS LAW IS GUILTY OF A MISDEMEANOR AND SUBJECT TO A FINE NOT EXCEEDING $100.

FOR MASSACHUSETTS APPLICANTS:  IT IS UNLAWFUL IN MASSACHUSETTS TO REQUIRE OR ADMINISTER A LIE DETECTOR TEST AS A CONDITION OF EMPLOYMENT OR CONTINUED EMPLOYMENT. AN EMPLOYER WHO VIOLATES THIS LAW SHALL BE SUBJECT TO CRIMINAL PENALTIES AND CIVIL LIABILITY.

FOR MONTANA APPLICANTS: THE EMPLOYMENT RELATIONSHIP IS GOVERNED BY THE WRONGFUL DISCHARGE FROM EMPLOYMENT ACT, AND THE COMPANY’S PROBATIONARY PERIOD IS 18 MONTHS. MONT. CODE ANN. § 39-2-901, AS AMENDED.

FOR RHODE ISLAND APPLICANTS:  IF YOU PROVIDE FALSE INFORMATION ABOUT YOUR ABILITY TO PERFORM THE ESSENTIAL FUNCTIONS OF THE JOB, WITH OR WITHOUT ACCOMMODATIONS, YOU MAY BE BARRED FROM FILING A CLAIM UNDER the provisions of the Workers’ Compensation Act of the State of Rhode Island.

Please include Street Information and City, State and Zip Code as well

U.S. Standard Demographic Questions

We invite applicants to share their demographic background. If you choose to complete this survey, your responses may be used to identify areas of improvement in our hiring process.
Select...
Select...
Select...
Select...
Select...
Select...

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Iterative Health’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Select...
Select...
Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...

Voluntary Self-Identification of Disability

Form CC-305
Page 1 of 1
OMB Control Number 1250-0005
Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

  • Alcohol or other substance use disorder (not currently using drugs illegally)
  • Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
  • Blind or low vision
  • Cancer (past or present)
  • Cardiovascular or heart disease
  • Celiac disease
  • Cerebral palsy
  • Deaf or serious difficulty hearing
  • Diabetes
  • Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
  • Epilepsy or other seizure disorder
  • Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
  • Intellectual or developmental disability
  • Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
  • Missing limbs or partially missing limbs
  • Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
  • Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
  • Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
  • Partial or complete paralysis (any cause)
  • Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
  • Short stature (dwarfism)
  • Traumatic brain injury
Select...

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.