Corporate IT and Security Engineer

Zest Health is redefining care for the 40M+ Americans with chronic dermatologic conditions like eczema and psoriasis. Through our virtual dermatology clinic, Zest is making care more accessible, effective, and affordable. Join our well-resourced, passionate team as we set the new gold standard for value-based specialty care.

We're hiring our first dedicated Corporate IT and Security Engineer . Today these responsibilities are spread across the software engineering team. You'll take them over and build the processes that let us grow without security and compliance becoming a bottleneck.

This is a hands-on role with broad ownership. In a typical week, you might add a new application to Okta and wire up its provisioning, run a quarterly access review, ship a new device policy in our MDM, close out a control in our compliance platform, draft answers to a client security questionnaire, or flag a new vulnerability to the engineering team and track it to remediation.

You don't need to have done all of this before. You need a solid foundation in identity, endpoints, and security fundamentals, the judgment to know what matters, and the drive to own a function at a fast-growing startup. As the company scales, this role grows with it.

We expect AI to be part of how you work, not a novelty. You'll have LLM tooling and MCP connections to Vanta and our other systems, and we want you to use them to automate the repetitive parts of IT, security, and compliance so your time goes to judgment calls. You'll also help decide how the rest of the company uses AI safely.

Engineering will continue to own secure product development. You'll be the SME in the threat landscape: you'll help set standards, track security developments that affect our stack, coordinate testing, and make sure findings get fixed.

Administer Okta: add and configure new applications, manage SSO and MFA, and maintain groups and access policies

Own access provisioning and deprovisioning across every system we use, developing sustainable and clear SLAs to support the entire organization

Own the employee onboarding and offboarding process, from the first-day laptop to the last-day access removal, and keep it fast, reliable, and auditable

Run regular access reviews and make sure least-privilege holds up over time

Automate repetitive identity work, such as access requests, provisioning steps, and access review prep, with Okta Workflows, scripting, and AI-assisted tooling

Manage our MDM: enrollment, device policies, encryption, patching, and endpoint compliance

Maintain an accurate inventory of devices, applications, accounts, and licenses

Serve as the first point of contact for employee IT and security questions

Own day-to-day operation of our compliance program: control monitoring, evidence collection, audit preparation, and coordination with auditors

Own policy approvals and the annual policy review cycle

Administer HIPAA and security awareness training and track completion

Create and maintain the processes and policies we need to meet compliance requirements, including incident notification procedures

Track security developments, vulnerabilities, and vendor advisories relevant to our stack and drive remediation

Own responses to client security assessments and questionnaires, and maintain a reusable library of security and compliance answers

Support client audits and security reviews as our healthcare partnerships continually expand

Partner with Engineering on application security standards, dependency and vulnerability scanning, and penetration test coordination

Track application security findings through remediation and verify that critical issues are resolved

Help engineers adopt new tools with appropriate access, privacy, and data controls

You'll be the owner of IT, identity, and compliance at a fast-growing company, not a ticket queue at a large one

The scope of this role expands as the company does. Successful people in this seat grow into senior security, GRC, or IT leadership roles

Do meaningful work alongside dynamic, mission-driven teammates

Opportunity to join a high-growth start-up that is revolutionizing care delivery for dermatology patients

Robust compensation package inclusive of competitive pay, equity grants, and retirement plan matching

Employer-sponsored medical, dental, and vision plans

This role is not eligible for visa sponsorship, now or in the future. Candidates must be authorized to work in the U.S. without sponsorship.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other legally protected basis, in accordance with applicable law.