Security Engineer II

About   Iovance Biotherapeutics, Inc.

Iovance Biotherapeutics, Inc.  is the global leader in innovating, developing, and delivering tumor infiltrating lymphocyte (TIL) cell therapies for patients with solid tumors. Amtagvi® (lifileucel) is the first FDA-approved, one-time treatment for previously treated advanced melanoma, now approved in three global markets and available at more than 95 authorized treatment centers. The  Iovance TIL platform  spans registrational trials and next-generation programs in additional solid tumors, including gene-edited and IL-12 tethered TIL therapies, next-generation IL-2, and precision immuno-oncology approaches. As the first and only company to take TIL therapy from concept to a broadly accessible commercial treatment, Iovance operates as an end-to-end cell therapy company, anchored by fully owned, centralized U.S.-based manufacturing that is scaled to serve thousands of cancer patients worldwide each year. For more information, please visit  www.iovance.com.

Amtagvi® and its accompanying design marks, Proleukin ®, Iovance ®, and IovanceCares™ are trademarks and registered trademarks of Iovance Biotherapeutics, Inc. or its subsidiaries. All other trademarks and registered trademarks are the property of their respective owners.

Information on Iovance’s broad, industry-leading patent portfolio is available on the Intellectual Property page on  www.iovance.com.

Overview

We are seeking a hands-on Security Engineer with strong technical depth across endpoint, cloud, identity, and email security. This role designs, deploys, and operates Iovance’s core security platforms, including CrowdStrike Falcon EDR and Next-Gen SIEM, privileged access management, Mimecast, AWS security services, and GitHub security. The right candidate builds policy, writes detections and automation, troubleshoots across the stack, and documents their work to the standard expected in a validated, audit-ready environment.

Essential Functions and Responsibilities

Endpoint Detection, SIEM & Response (CrowdStrike)

• Administer and tune CrowdStrike Falcon prevention policies, host groups, device control, and sensor updates across Windows, macOS, and Linux, with careful exclusion management for GxP and manufacturing systems
• Onboard and normalize log sources (Okta, AWS, Mimecast, GitHub, PAM, servers) into Falcon Next-Gen SIEM, and build detections, dashboards, and Falcon Fusion SOAR workflows
• Investigate alerts, conduct threat hunting, and drive containment and remediation

Privileged Access Management

• Operate the enterprise PAM platform, including vaulting, credential rotation, session recording, and just-in-time access for servers, cloud accounts, databases, and service accounts
• Integrate PAM with Okta and Active Directory, and support privileged access reviews and segregation-of-duties controls

Email Security (Mimecast)

• Administer Mimecast targeted threat protection, DLP, archiving, and continuity policies, and maintain SPF, DKIM, and DMARC
• Investigate phishing, impersonation, and business email compromise attempts

Cloud & DevSecOps Security (AWS, Microsoft 365 & GitHub)

• Secure AWS workloads including EC2, ECS, ELB/ALB, S3, and VPC networking, using AWS WAF, IAM, KMS, GuardDuty, Security Hub, Config, and CloudTrail
• Identify and remediate misconfigurations, enforce least privilege, and review infrastructure-as-code (Terraform/CloudFormation)
• Harden and monitor Microsoft 365, including Entra ID Conditional Access, Exchange Online, SharePoint/OneDrive/Teams sharing controls, Microsoft Purview DLP and sensitivity labels, and Microsoft Secure Score recommendations
• Administer GitHub Advanced Security (code scanning, secret scanning, Dependabot), branch protection, and organization policies, and secure GitHub Actions pipelines using OIDC federation to AWS

Governance, Compliance & Operations

• Author technical documentation, standards, and runbooks suitable for GxP, SOX, and HIPAA audits, and provide audit evidence
• Participate in change control, vulnerability and patch management, incident response, and on-call rotation

Required Education, Skills, and Knowledge

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience
• 5+ years of hands-on experience in security engineering or cloud security
• Hands-on experience with CrowdStrike Falcon EDR and a SIEM platform, preferably Falcon Next-Gen SIEM (LogScale), including detection development
• Experience administering an enterprise PAM solution (e.g., CyberArk, BeyondTrust, Delinea)
• Experience with Mimecast or a comparable secure email gateway
• Practical experience securing AWS environments (EC2, ECS, ELB, S3, WAF, IAM, VPC)
• Hands-on experience securing Microsoft 365, including Entra ID, Conditional Access, Exchange Online, and Purview
• Working knowledge of GitHub security features and CI/CD security
• Solid foundation in networking, DNS, TLS, and identity protocols (SAML, OIDC, OAuth, LDAP)
• Scripting experience in Python, PowerShell, or Bash
• Strong written communication and audit-ready documentation skills

Preferred Education, Skills, and Knowledge

• Experience in a regulated life sciences or healthcare environment (GxP, 21 CFR Part 11, HIPAA, SOX)
• Experience with Okta and Microsoft Entra ID/Intune
• Familiarity with Terraform, NIST CSF, NIST 800-53, and CIS Controls
• Certifications such as CrowdStrike CCFA/CCFR/CCFH, AWS Certified Security – Specialty, CISSP, or GIAC

Physical Demands and Activities Required

The physical demands described here represent those an employee may encounter while performing the essential functions of this job. Reasonable accommodation may be provided to enable individuals to perform these functions.

• Ability to remain in a stationary position for extended periods
• Ability to move about within an office or remote workspace and exert up to 10 pounds of force occasionally
• Visual acuity sufficient for preparing and analyzing data, viewing computer screens, and extensive reading
• Repetitive motion involving wrists, hands, and/or fingers
• Ability to communicate effectively to exchange information
• Ability to engage in analytical, conceptual, and problem‑solving activities in a dynamic business environment

Mental: Clear and conceptual thinking ability; excellent judgment, troubleshooting, problem-solving, analysis, and discretion; ability to handle work-related stress; ability to handle multiple priorities simultaneously with a sense of urgency; and ability to meet deadlines

Work Environment

This job operates in a professional or remote office environment and requires operating standard office equipment and keyboards.

#li-remote

The annual base salary we reasonably expect to pay is listed. Individual pay decisions depend on various factors, such as primary work location, complexity and responsibility of the role, job duties/requirements, and relevant education, experience and skills.

Pay Transparency

$125,000 — $140,000 USD

The statements contained in this document are intended to describe the general nature and level of work being performed by a colleague assigned to this description. They are not intended to constitute a comprehensive list of functions, duties, or local variances. Management retains the discretion to add or to change the duties of the position at any time.

Iovance is committed to cultivating and offering a diverse and inclusive work environment. As an equal-opportunity employer, our employees and applicants will be considered without regard to an individual’s race, color, religion, sex, pregnancy, national origin, age, physical and mental disability, marital status, sexual orientation, gender identity, gender expression, genetic information, military and veteran status, and any other characteristic protected by applicable law. If you need assistance or accommodation to apply to one of our opportunities, please contact [email protected].

By voluntarily providing information and clicking “Submit Application”, you explicitly consent to the collection and use of your personal information for the purposes described above and in our Candidate Privacy Notice.