Manager, IT Security in at National Medical Billing Services

Why work at nimble?

This is a great opportunity to join a well-established and market-leading brand serving a high-growth end market while gaining valuable experience working closely with Executive leadership. As an organization, we are in high-growth mode through acquisition with a laser focus on positive culture building!

Who we are!

nimble solutions is a leading provider of revenue cycle management solutions for ambulatory surgery centers (ASCs), surgical clinics, surgical hospitals, and anesthesia groups. Our tech-enabled solutions allow surgical organizations to streamline their revenue cycle processes, reduce administrative burden, and improve financial outcomes. Join over 1,100 surgical organizations that trust nimble solutions and its advisors to bring deep insights and actionable intelligence to maximize their revenue cycle.

The Manager, IT Security leads day-to-day security operations and engineering for the company: coordinating with our managed security services provider (MSSP) on SOC alerting and response, driving vulnerability and identity/access management programs, maintaining incident response readiness, and supporting our SOC 2 Type II, HIPAA, and NIST CSF compliance programs. This person manages a small cross-border team of security practitioners and is the operational backbone of the security function as the broader organization builds out, including future Director and GRC leadership roles.

On a typical day, you'll be responsible for:

• Own day-to-day security tooling and operations: EDR/XDR, SIEM, data-loss prevention, device compliance, and Conditional Access / Zero Trust controls across the Microsoft security stack (Defender for Endpoint, Sentinel, Purview, Intune, Entra ID)
• Lead the Daily Security Huddle and weekly Vulnerability Management meeting; drive vulnerability remediation to closure against defined SLAs
• Own the identity and access management program: MFA, Conditional Access, privileged access management, RBAC, and joiner/mover/leaver automation
• Serve as the primary internal point of contact for the managed security services provider (MSSP/vCISO) on SOC alert triage, escalation, and remediation follow-through
• Maintain and continuously improve the incident response playbook and runbooks, aligning internal procedures with the MSSP's SOC processes and pre-defined escalation thresholds
• Coordinate tabletop exercises and post-incident reviews, and act as a security escalation point for active incidents
• Support the annual SOC 2 Type II audit cycle — evidence collection, control walkthroughs, and auditor liaison — in partnership with the compliance/GRC function
• Maintain NIST CSF control documentation and contribute to ongoing risk-remediation (POA&M) efforts
• Support HIPAA/PHI security controls and periodic risk assessments; coordinate annual third-party penetration testing and remediation
• Directly manage the security engineering/operations team, spanning U.S. and India-based staff
• Own performance management, coaching, and bench-strength / succession planning within the team
• Partner closely with Infrastructure, Workplace Services (help desk/IAM), and Development leadership on cross-functional security initiatives

Who you are:

• 10+ years in information security operations or engineering, including 2+ years in a people-management or team-lead capacity
• Hands-on experience with the Microsoft security stack — Defender for Endpoint, Sentinel, Purview, Intune, Entra ID (Conditional Access, MFA, PIM)
• Experience supporting SOC 2 Type II and/or HIPAA compliance programs (evidence gathering, control testing, auditor engagement)
• Experience managing or closely partnering with a managed security services provider (MSSP) / outsourced SOC
• Experience building or maturing an incident response program, including playbooks and tabletop exercises
• Comfortable managing distributed, cross-border teams (U.S. and India)
• Strong written and verbal communication skills, with the ability to translate technical risk into business terms for non-technical stakeholders