IT and Security Generalist at Galileo

United States

$110k - $120k

<div class="content-intro"><p><strong>About Us</strong></p> <p><span style="font-weight: 400;">Galileo is a team-based medical practice working to improve the quality and affordability of health care for all. Operating across 50 states, Galileo offers high-touch, data-driven, multi-specialty, longitudinal care to diverse and complex patients—on the phone, in the home, and everywhere in between. Regional and national health plans, employers, and Fortune 500 organizations trust Galileo as the leading solution to improve population health. Founded by Dr. Tom X. Lee, the healthcare pioneer behind One Medical and Epocrates, Galileo is a team of leading innovators from healthcare, technology, and human-centered design. Our mission is to apply that talent and scientific thinking to</span><span style="font-weight: 400;"> transform society by solving our largest, toughest healthcare problems, while at the same time bringing patient and provider closer.</span></p></div><p><strong>About the Role</strong></p> <p>The Galileo IT and Security team runs identity, endpoints, workforce tooling, security monitoring, and the automation that ties those systems together. That automation is already built and in production: employee onboarding and offboarding, device lifecycle, security alert triage, audit evidence collection, and workforce support all run as workflows with AI-assisted steps, with a person stepping in only for exceptions and decisions. The breadth of this role is possible because the systems handle the volume.</p> <p>In this role, you will operate that estate, keep it healthy, and extend it where manual work still exists. The scope spans identity and endpoint administration, corporate security monitoring, and minimal workforce support, but the day-to-day is exception handling, review, and building, not ticket volume. Most days you will spend more time improving a workflow than repeating a task.</p> <p>We are hiring for trajectory. The right candidate is experienced in their career, has more range than depth, and wants to grow into a security engineer by doing the work.</p> <p>This is a full-time remote position, reporting to our Head of IT and Security.</p> <p><strong>What you will do:</strong></p> <p><span style="text-decoration: underline;">Identity and endpoints</span></p> <ul> <li>Administer identities in Okta (users, groups, applications, device trust).</li> <li>Manage the MacBook fleet through the MDM platform: enrollment, configuration, compliance, remote actions.</li> <li>Monitor and refine onboarding and offboarding through the existing automated lifecycle workflows and handle the exceptions they surface.</li> </ul> <p><span style="text-decoration: underline;">Automation</span></p> <ul> <li>Maintain and extend the automation estate that runs lifecycle, monitoring, and reporting workflows, including the LLM-assisted triage steps built using GenAI.</li> <li>Own the workflows you build: monitor them, fix failures, retire what no longer serves a purpose.</li> <li>Build new automation for manual processes across the company, working with the teams that own those processes.</li> </ul> <p><span style="text-decoration: underline;">Security operations</span></p> <ul> <li>Respond to alerts from endpoint protection, cloud monitoring, and identity systems within defined SLAs.</li> <li>Investigate and document security events; escalate incidents per the incident handling procedure.</li> <li>Support vulnerability management: review findings, track remediation with engineering, report status.</li> </ul> <p><span style="text-decoration: underline;">Application security (part-time)</span></p> <ul> <li>Participate in security review of engineering changes, integrations, and vendor connections.</li> <li>Review authentication, authorization, and data handling patterns in internal applications and workflows.</li> <li>Work with engineering to set secure defaults from the start, instead of reviewing security after changes are made.</li> </ul> <p><span style="text-decoration: underline;">Audit and evidence</span></p> <ul> <li>Make sure automated evidence collection continues to work and look into any gaps flagged by the reconciler.</li> <li>Gather and prepare evidence samples for SOC 2 and HITRUST assessments when automation does not handle a request.</li> </ul> <p><span style="text-decoration: underline;">Workforce support</span></p> <ul> <li>Handle support requests that need system access or judgment beyond what the helpdesk bot and knowledge base can provide.</li> <li>Write and update end-user documentation using clear, simple language.</li> </ul> <p><strong>How we work</strong></p> <ul> <li>We are a small team that values trust and clear communication. In our standups, we focus on the key points rather than getting into too much detail.</li> <li>We prefer automation. If a task is likely to occur again, we create a solution rather than doing it by hand each time. Alert triage, lifecycle actions, and evidence collection already work this way, so our on-call and ticket load stay light.</li> <li>We keep clear records. We track decisions, changes, and status updates in our project management tools.</li> <li>We test changes before they go live. Work is only done when it works in production.</li> </ul> <p><strong>Growth path</strong></p> <p>This role is meant to help you develop your skills. As you show what you can do, you will take on more responsibility for different systems and workflows. The next step is to become a Security Engineer with a focus area, like identity, detection and response, or application security. You and the Head of IT and Security will choose this specialty together, based on your strengths and Galileo's needs.</p> <p><strong>About You</strong></p> <ul> <li>You communicate clearly in writing and can explain a problem, a decision, and its status in just a few sentences.</li> <li>You take responsibility for your work, making sure what you build keeps working. You monitor systems and fix issues as soon as they come up.</li> <li>You have 4-5 years of experience in fast-moving IT, security operations, or systems administration environments, or equivalent proven experience.</li> <li>Working knowledge of identity systems (Okta or equivalent) and macOS administration.</li> <li>Some scripting experience and an understanding of the fundamentals. Experience with workflow automation tools, LLMs, and APIs, or a strong interest in learning them.</li> <li>Familiarity with security fundamentals: authentication, least privilege, and logging.</li> <li>You understand when to decide on your own and when to ask for advice. You discuss decisions before acting on them and let the team know about any blockers right away.</li> </ul> <p><strong>Nice to have:</strong></p> <ul> <li>Exposure to HIPAA, SOC 2, or HITRUST environments.</li> <li>AWS or GCP administration.</li> <li>Experience with EDR, SIEM, or cloud security monitoring tools.</li> <li>A security certification in progress or completed.</li> </ul> <p><strong>Compensation:</strong> $110,000-120,000 annually based upon prior experience, performance, and market dynamics. This role is eligible for a 10% bonus.</p> <p><strong>Benefits Offered:</strong></p> <ul> <li>Medical / Dental / Vision insurance</li> <li>Flexible Spending Account</li> <li>Health Savings Account + match</li> <li>Company paid STD/LTD, AD&amp;D, and Life insurance</li> <li>Paid Family Leave</li> <li>401K + match</li> <li>Paid Time Off</li> </ul><div class="content-conclusion"><p><strong>How We Hire</strong></p> <p>Galileo Health is an equal-opportunity employer and welcomes applicants from all backgrounds.</p> <p>We have recently become aware of the fraudulent use of our name on job postings and via recruiting emails that are illegitimate and not in any way associated with us. We will never ask you to provide sensitive personal information as part of the recruiting process, such as your social security number; send you any unsolicited job offers or employment contracts; require any fees, payments or access to any financial accounts; and/or conduct text-only interviews. If you suspect you are being scammed or have been scammed online, you may report the crime to the <a href="http://www.ic3.gov/">Federal Bureau of Investigation</a>&nbsp;and obtain more information regarding online scams at the&nbsp;<a href="https://www.consumer.ftc.gov/">Federal Trade Commission</a>.</p></div>