Security Analyst

Remote: yes Posted: 2026-10-20

Title: Security Analyst | Location: US Remote | Reports To: Sr. Director of InfoSec and IT This is a remote role requiring that you live in and physically perform all work in the United States.

Next Steps

Private Health Management is a remote company with employees across the United States. If your application is selected for next steps, you’ll hear from a member of our recruiting team about the interview process, which may include conversations with the hiring manager, peers, and department leaders, conducted virtually by Zoom or phone.

PHM may use AI-enabled tools at certain points in the recruiting process to help us review candidates consistently and give more qualified applicants an opportunity to be considered beyond their resume. AI tools may support parts of the process, but they do not make hiring decisions. All hiring decisions are made by human reviewers.

Have a quick question about the role or our process? Email careers@privatehealth.com or simply apply here.

Anticipated Pay Range

$110,000—$140,000 USD

The Security Analyst is a hands-on member of the InfoSec team within PHM’s Technology Department. This role will own significant portions of the day-to-day security operations program, including security monitoring, incident response, access governance, vulnerability management, vendor risk, audit evidence, and cloud and SaaS security.

This role is designed to add execution depth to a growing security program and reduce dependence on a single person for both strategy and operations. The analyst will have meaningful ownership and broad exposure across the security function, with the opportunity to improve how issues are prevented, investigated, documented, and resolved.

What You’ll Accomplish

- Establish a continuous compliance evidence process where recurring control activities have clear owners and due dates, evidence is captured as work happens, and SOC 2 Type II and HITRUST i1 assessments can be supported without a last-minute evidence sprint.

- Reduce recurring misdirection incidents by using observed patterns to improve DLP and external send controls and by partnering with owning teams to address upstream workflow causes.

- Build reliable access governance by verifying provisioning and deprovisioning, identifying and removing dormant or excessive access on a recurring cycle, reviewing privileged access on schedule, and validating MSP handoffs rather than assuming completion.