We Breathe Life Into Data
At Komodo Health, our mission is to reduce the global burden of disease. And we believe that smarter use of data is essential to this mission. That’s why we built the Healthcare Map — the industry’s largest, most complete, precise view of the U.S. healthcare system — by combining de-identified, real-world patient data with innovative algorithms and decades of clinical experience. The Healthcare Map serves as our foundation for a powerful suite of software applications, helping us answer healthcare’s most complex questions for our partners. Across the healthcare ecosystem, we’re helping our clients unlock critical insights to track detailed patient behaviors and treatment patterns, identify gaps in care, address unmet patient needs, and reduce the global burden of disease.
As we pursue these goals, it remains essential to us that we stay grounded in our values: be awesome, seek growth, deliver “wow,” and enjoy the ride. At Komodo, you will be joining a team of ambitious, supportive Dragons with diverse backgrounds but a shared passion to deliver on our mission to reduce the burden of disease — and enjoy the journey along the way.
The Opportunity at Komodo Health
You will engineer and run Corporate IT Security at Komodo Health, protecting the employee environment across identity, devices, endpoints, internal networks, workforce SaaS and AI tools, and workforce-related risk. Komodo works with sensitive healthcare data, so getting corporate security right matters to our customers.
This role sits in IT and works closely with the Security team, which owns security monitoring, cloud and production security, and the company incident response program. You will lead incidents in the corporate environment under that program and act as IT’s security partner for Legal, Compliance and business leaders.
This is a senior individual contributor role, and you will not manage a team. Expect at least 70% of your time to be hands-on: configuring, scripting, investigating and remediating. The rest goes to corporate incident response, documentation and cross-functional partnership.
Looking back on your first 12 months at Komodo Health, you will have…
- First 90 days: a current-state assessment of corporate identity, devices and SaaS, delivered as a sequenced remediation backlog with named owners. The highest-risk exposures are addressed first.
- Access to business-critical applications is tied to device posture, and privileged access consistently uses phishing-resistant MFA.
- Applications are provisioned and deprovisioned through the identity provider. Offboarding SLAs are measured and met, and access reviews complete on schedule with clean evidence.
- Workforce SaaS applications have least-privilege export and API rights, session protections and a governed OAuth and connected-app inventory, and corporate secrets are kept out of SaaS and collaboration tools.
- New identity, endpoint and SaaS-abuse detection use cases are delivered with Security, and corporate alerts routed to IT have a defined owner and response.
- At least two tabletop exercises have run with IT, Security, Legal and Communications, and every corporate incident closes with a post-incident review whose follow-ups are tracked to completion.
- Governance for shadow IT, risky OAuth grants and workforce AI adoption is in place, and it enables the business rather than slowing it down.
You will accomplish these outcomes through the following responsibilities…
- Identity and access hardening in our enterprise identity provider and productivity suite: phishing-resistant MFA, consistent SSO enforcement, session and sign-on policies, least-privilege admin roles, and governance of service and non-human accounts.
- Device trust and conditional access: use device-posture tooling with our MDM and EDR across a mixed macOS and Windows fleet, so access to business systems depends on device health.
- Joiner-mover-leaver integrity: every app provisioned through the identity provider with no out-of-band accounts, timely and verified deprovisioning, offboarding exceptions tracked to closure, and access reviews that hold up in an audit.
- Workforce SaaS security posture: data export and API access controls, session protections, OAuth and connected-app governance, audit-log monitoring, and detection of shadow IT and configuration drift.
- Corporate incident response: act as Incident Commander for incidents limited to the corporate environment, under the company incident response process, which sets severity and keeps the incident record. Security leads once production, cloud or customer data is involved, and you support those incidents with IT expertise. Coordinate IT, Legal, Compliance and Communications, drive investigation and remediation, and run blameless post-incident reviews with follow-ups tracked to completion.
- Workforce AI guardrails: approved-tool standards, SSO and domain capture, RBAC, retention, logging and access reviews for the AI tools, connectors and integrations employees use, with new-tool intake feeding the existing vendor security review. AI in our products and engineering workflows stays with Security.
What you bring to Komodo Health (required):
- 6–8+ years in corporate security, IT security, security engineering or security operations, including 4+ years of hands-on engineering of corporate controls at a cloud-native or SaaS company. This is an individual contributor role, so people-management experience isn’t required.
- Deep, hands-on experience with an enterprise identity provider and its protocols (SAML, OIDC, OAuth 2.0, SCIM), including sign-on and session policies, device assurance or conditional access, and lifecycle automation.
- Hands-on experience with device trust, MDM and EDR across macOS and Windows, including rolling out posture-based access without breaking productivity.
- Experience hardening productivity suites and major SaaS platforms: admin roles, export and API permissions, OAuth app governance and audit logging.
- Experience defining detection use cases and writing or tuning detection rules alongside a security operations team.
- You have served as incident commander or lead responder on real security incidents, made containment decisions under pressure, and run post-incident reviews that led to real change.
- Production-quality scripting in Python or similar, and experience integrating security tools through APIs.
- Experience producing control evidence for SOC 2 and other audits.
- Clear writing and executive communication. You can translate technical risk into business impact and decisions, and you get work done through influence across IT, Engineering, Security, Legal, People and Procurement. You’ve partnered with Legal and Compliance on investigations, audits or regulatory reviews.
- Use AI in your own work for triage, investigation, documentation and automation, with clear human accountability for every decision.
Additional skills and experience we’d prioritize (nice to have)…
- Experience in healthcare, life sciences or another environment handling regulated or sensitive data.
- Experience at a high-growth company through Series C–E or pre-IPO stages.
- Identity workflow automation, identity threat detection or device-assurance integrations.
- Experience with SSPM or compliance-automation platforms.
- Insider-risk or DLP programs, or digital forensics.
- Evaluating and implementing enterprise security vendors.
- Certifications such as GCIH or CISSP.
#LI-Remote
The pay range for each job posting reflects a minimum and maximum range of annual base pay that we reasonably expect to pay for this position within the US. We carefully consider multiple business-related factors when determining compensation, including job-related skills, work experience, geographic work location, relevant training and certifications, business needs and market demands.
The starting annual base pay for this role is listed below. This position may be eligible for performance-based bonuses as determined in the Company’s sole discretion and in accordance with a written agreement or plan. This role may also be eligible for equity awards. In addition, this role is eligible for benefits including, but not limited to, comprehensive health, dental, and vision insurance; flexible time off and holidays; 401(k) with company match; disability insurance and life insurance; and leaves of absence in accordance with applicable state and local laws and regulations and company policy.
Komodo's AI Standard
At Komodo, we're not just witnessing the AI revolution – we're leading it. This is a pivotal moment in time, where being first to market with AI transforms industries and sets the bar. We've already established industry leadership in leveraging AI to revolutionize healthcare, and we expect every team member to contribute. AI here isn't optional; it's foundational. We expect you to integrate AI into your daily work – from summarizing documents to automating workflows and uncovering insights. This isn't just about efficiency; it's about making every moment more meaningful, building on trust in AI, and driving our collective success.
Join us in shaping the future of healthcare intelligence.
Where You’ll Work
Komodo Health has a hybrid work model with hubs in San Francisco, New York City, and Chicago. Roles vary — some can be performed from anywhere in the country, others are scoped to a specific region, and some are based near one of our hubs. For hub-based Dragons, we're building intentional in-office rhythms alongside the flexibility that's core to how we work. Whatever your setup, expectations will always be clear before you join.
Equal Opportunity Statement
Komodo Health provides equal employment opportunities to all applicants and employees. We prohibit discrimination and harassment of any type with regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.
By submitting your application, you acknowledge that you have read and understand Komodo Health’s Privacy Notice for Employees and Contractors.
This notice explains how we collect, use, and retain applicant data.
Skills Required
- 6-8+ years of experience in corporate security, IT security, security engineering, or security operations
- 4+ years of hands-on engineering of corporate security controls at a cloud-native or SaaS company
- Deep hands-on experience with an enterprise identity provider and SAML, OIDC, OAuth 2.0, and SCIM
- Experience with sign-on and session policies, device assurance or conditional access, and lifecycle automation
- Hands-on experience with device trust, MDM, and EDR across macOS and Windows
- Experience hardening productivity suites and major SaaS platforms, including admin roles, export and API permissions, OAuth app governance, and audit logging
- Experience defining detection use cases and writing or tuning detection rules with a security operations team
- Experience serving as incident commander or lead responder on real security incidents
- Production-quality scripting experience in Python or a similar language and experience integrating security tools through APIs
- Experience producing control evidence for SOC 2 and other audits
- Clear technical writing and executive communication skills
- Experience partnering with Legal and Compliance on investigations, audits, or regulatory reviews
- Ability to use AI for triage, investigation, documentation, and automation with human accountability
- Experience in healthcare, life sciences, or another environment handling regulated or sensitive data
- Experience at a high-growth company through Series C-E or pre-IPO stages
- Experience with identity workflow automation, identity threat detection, or device-assurance integrations
- Experience with SSPM or compliance-automation platforms
- Experience with insider-risk or DLP programs, or digital forensics
- Experience evaluating and implementing enterprise security vendors
- GCIH or CISSP certification
Komodo Health Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Komodo Health and has not been reviewed or approved by Komodo Health.
-
Leave & Time Off Breadth — Time off and flexibility are positioned as a clear strength, including flexible time off, winter holiday office closures, and “Flex Friday Afternoons.” This is reinforced by an overall remote-friendly/hybrid-by-design approach that supports schedule flexibility.
-
Parental & Family Support — Paid parental leave is described as having expanded from 12 to 16 weeks, paired with a flexible return-to-work period. These policies suggest a more modern family-support package relative to many peers.
-
Retirement Support — A 401(k) with a company match is consistently referenced as part of the core package. Immediate vesting and a match around the mid-single digits are also repeatedly cited as part of the retirement offering.
Komodo Health Insights
What We Do
Improving lives through the largest, most actionable Healthcare Map™. At Komodo Health, we partner with our customers to improve patient care and reduce disease burden through data-driven insights. The Komodo Health Platform delivers patient-level insights by dynamically analyzing the broadest array of data across patients, practitioners, and health systems. We put patients at the center of clinical innovation. Healthcare today is all about delivering value — improving patient outcomes while reducing healthcare costs by helping our customers put life-saving therapies in the hands of people that need them the most. The Komodo Health software platform provides access to a broader array of healthcare stakeholders in over fifty therapeutic areas. Our comprehensive Healthcare Map™ helps: + Life Sciences extend the reach of innovative therapies + Patient Advocacy align investments toward the right patients and practitioners + Healthcare Practitioners address unmet medical needs in their communities + Payers increase care quality while reducing cost Let’s work together to reduce the burden of disease. Please learn more by visiting us at www.komodohealth.com
