Company Overview:

Cohere Health is a fast-growing clinical intelligence company that’s improving lives at scale by promoting the best patient-specific care options, using leading edge AI combined with deep clinical expertise. In only four years our solutions have been adopted by health insurance plans covering over 15 million people, while our revenues and company size have quadrupled. That growth combined with capital raises totaling $106M positions us extremely well for continued success. Our awards include: 2023 and 2024 BuiltIn Best Place to Work, Top 5 LinkedIn™ Startup, TripleTree iAward, multiple KLAS Research Points of Light, along with recognition on Fierce Healthcare's Fierce 15 and CB Insights' Digital Health 150 lists.

Opportunity Overview:

We are seeking a seasoned Security Architect to lead and enhance our Threat and Vulnerability Management (TVM) program, ensuring it aligns with internal policies and HIPAA/HITRUST compliance requirements. The Security Architect will be responsible for designing and maintaining the overarching security architecture, conducting vulnerability assessments, and collaborating with various teams to address security issues. This role will involve working closely with developers, system administrators, and senior leadership to protect our digital assets and ensure a robust security posture.

Last but not least: People who succeed here are empathetic teammates who are candid, kind, caring, and embody our core values and principles. We believe that diverse, inclusive teams make the most impactful work. Cohere is deeply invested in ensuring that we have a supportive, growth-oriented environment that works for everyone.

What you will do:

Threat and Vulnerability Management (TVM) Program:

Lead a comprehensive TVM program, ensuring it meets internal standards and complies with HIPAA/HITRUST requirements.
Conduct regular vulnerability scans using automated tools in a cloud-first environment, identifying vulnerabilities and assessing potential impacts.

Vulnerability Analysis and Prioritization:

Analyze vulnerability scan results, prioritize vulnerabilities based on risk, threat intelligence, and potential business impact.
Gather and analyze threat intelligence to proactively identify and mitigate threats, providing actionable insights to the relevant teams.

Collaboration and Remediation:

Collaborate with development teams, system administrators, and other stakeholders to ensure timely remediation of identified vulnerabilities and threats.
Lead remediation efforts, providing guidance and expertise to developers and system administrators.
Review and collaborate with developers to remediate Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) findings.

Incident Response and Reporting:

Participate in incident response efforts related to vulnerabilities, assisting in the investigation and mitigation of security incidents.
Assist in the creation and maintenance of vulnerability management reports and metrics, providing clear and concise updates to stakeholders.
Report TVM program results and insights to Senior Leadership, highlighting key findings, risks, and progress on remediation efforts.

Security Architecture Design and Maintenance:

Design and maintain the overarching security architecture for the organization, ensuring it aligns with policies and compliance requirements, including HIPAA/HITRUST.
Develop and implement security Identity Access Management (IAM) and Privileged Access Management (PAM) solutions
Collaborate with development teams to ensure security architecture requirements are integrated into the software development lifecycle and adhered to throughout the project lifecycle.

Threat Modeling and Risk Assessments:

Conduct threat modeling and risk assessments to identify potential security threats and vulnerabilities.
Define security architecture requirements and implement security hardening measures to protect systems and data.

Security Tools Deployment and Management:

Deploy and manage security tools and technologies, ensuring they are effectively integrated into the organization's security infrastructure.
Stay abreast of the latest security technologies and best practices, recommending and implementing improvements as needed.

Incident Response and Disaster Recovery Planning:

Participate in incident response and disaster recovery planning, ensuring the organization's readiness to respond to and recover from security incidents

Your background & requirements:

Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent work experience.
5+ years of experience in a security architecture or similar role, with a focus on vulnerability management and compliance.
Working knowledge of MITRE ATT&CK framework and D3FEND matrix
Strong knowledge of HIPAA/HITRUST requirements and cloud-first security practices.
Proficiency in vulnerability scanning tools and techniques, as well as experience in SAST/DAST.
Demonstrated experience in threat intelligence gathering and analysis
Demonstrated expertise in security tools and technologies, including SIEM, IDS/IPS, WAF, IAM and vulnerability assessment tools.
Strong problem-solving and analytical skills, with the ability to prioritize and manage multiple projects simultaneously.
Excellent communication and collaboration skills, with experience working closely with development teams and senior leadership.
Relevant certifications such as CEH, GCIH, ISSAP, CISSP, or similar are preferred.
Commitment to staying updated on the latest developments in cloud security and a proactive approach to continuous learning.

We can’t wait to learn more about you and meet you at Cohere Health!

Equal Opportunity Statement:

Cohere Health is an Equal Opportunity Employer. We are committed to fostering an environment of mutual respect where equal employment opportunities are available to all. To us, it’s personal.

The salary range for this position is $130,000 to $155,000; as part of a total benefits package which includes health insurance, 401k and bonus. In accordance with state applicable laws, Cohere is required to provide a reasonable estimate of the compensation range for this role. Individual pay decisions are ultimately based on a number of factors, including but not limited to qualifications for the role, experience level, skillset, and internal alignment.

#LI-Remote

#BI-Remote

Apply for this Job

* Required

First Name *

Last Name *

Email *

Phone *

Resume/CV *

Dropbox Google Drive

(File types: pdf, doc, docx, txt, rtf)

Cover Letter

Dropbox Google Drive

(File types: pdf, doc, docx, txt, rtf)

LinkedIn Profile

Website

Have you performed threat hunting, red team, or blue team exercises? *

Are you experienced with Utilized Managed Detection and Response tools like (Expel, Red Canary, Artic Wolf)? *

Do you have an Offensive Security Certified Professional (OSCP) cert? *

Do you have a Certified Ethical hacker (CEH) cert? *

How did you hear about us? *

Do you now, or will you in the future require immigration sponsorship for work authorization? *

Are you eligible and legally able to work in the United States? *

Are you at least 18 years of age? *

Are you currently, or have you ever been, excluded from, debarred or otherwise ineligible to participate in state or federally funded programs (“Government Programs”) or federal healthcare programs as defined in 42 USC § 1320a-7b(f) (“Federal Programs”)? *

I understand that if I receive an offer of employment from Cohere Health that a background check that includes a criminal background check will be performed on my behalf. *

I HAVE READ THE CERTIFICATION ABOVE AND UNDERSTAND AND AGREE TO ITS TERMS. Please type your name and the date. *

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Cohere Health’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Gender

Are you Hispanic/Latino?

Please identify your race

Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Veteran Status

Voluntary Self-Identification of Disability

Form CC-305

Page 1 of 1

OMB Control Number 1250-0005

Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

Alcohol or other substance use disorder (not currently using drugs illegally)
Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
Blind or low vision
Cancer (past or present)
Cardiovascular or heart disease
Celiac disease
Cerebral palsy
Deaf or serious difficulty hearing
Diabetes
Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
Epilepsy or other seizure disorder
Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
Intellectual or developmental disability
Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
Missing limbs or partially missing limbs
Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
Partial or complete paralysis (any cause)
Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
Short stature (dwarfism)
Traumatic brain injury

Disability Status

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.

Enter the verification code sent to to confirm you are not a robot, then submit your application.

Security Code *

This application was flagged as potential bot traffic. To resubmit your application, turn off any VPNs, clear the browser's cache and cookies, or try another browser. If you still can't submit it, contact our support team through the help center.

Threat/Vulnerability Management, Lead

Apply for this Job

Voluntary Self-Identification

Voluntary Self-Identification of Disability