Manager of Security and Compliance

Accountabilities

• Own and continuously mature security, privacy, and compliance programs covering HIPAA, SOC 2, HITRUST, and applicable healthcare privacy requirements.

• Lead HITRUST certification end to end, including scoping, readiness assessments, evidence collection, assessor coordination, remediation, and corrective action plans.

• Manage internal and external audits, risk assessments, penetration tests, security reviews, evidence collection, and remediation activities.

• Build a path toward continuous, system-generated compliance rather than relying primarily on point-in-time evidence collection.

• Manage external security and compliance partners, including advisors, assessors, and penetration-testing providers, ensuring clear scopes, priorities, accountability, and remediation ownership.

• Maintain the security and compliance roadmap, ensuring vulnerabilities, risks, audit findings, and control gaps have defined owners and resolution plans.

• Partner with Engineering, Product, Platform, SRE, and IT to integrate security into architecture, infrastructure, product development, and the software development lifecycle.

• Establish security and PHI-handling standards and guardrails, including considerations for AI-assisted development.

• Oversee critical controls including identity and access management, logging and monitoring, encryption, vulnerability management, data retention, data protection, and vendor risk.

• Lead security incident response, including investigation, stakeholder communication, post-incident reviews, and corrective actions within a unified incident-management framework.

• Maintain security policies, procedures, Business Associate Agreements, data-handling requirements, and breach-response plans.

• Serve as the operational lead for HIPAA Security Rule obligations while supporting the designated HIPAA Security Official and collaborating with the Privacy Officer.

• Support customer security reviews, due diligence, onboarding, and security and privacy requirements during contract negotiations.

• Establish security and compliance metrics that provide leadership with clear visibility into risks, incidents, vulnerabilities, remediation progress, and audit readiness.

• Lead security awareness and compliance training while managing, developing, and mentoring the security and compliance team.

Requirements

• 7+ years of experience in information security, healthcare compliance, privacy, risk management, or a closely related discipline, preferably within healthcare SaaS or health technology.

• Strong working knowledge of HIPAA, SOC 2, HITRUST, healthcare privacy requirements, and security control frameworks.

• Demonstrated experience leading audits, risk assessments, compliance programs, remediation initiatives, and external security or compliance partners.

• Proven experience serving as the accountable owner for at least one HITRUST certification, either i1 or r2, from scoping through evidence collection, assessor management, and corrective action planning.

• Practical knowledge of cloud and SaaS security, identity and access management, vulnerability management, encryption, logging, data protection, and incident response.

• Experience partnering with Engineering and Product teams to integrate security into technology architecture and development processes.

• Experience with vendor risk management and third-party security assessments.

• Strong communication skills, with the ability to translate technical, regulatory, and security requirements for both technical and non-technical stakeholders.

• Experience working with healthcare technology, electronic medical records, clinical systems, or sensitive healthcare data environments.

• Experience in PACE, value-based care, Medicare/Medicaid, or other regulated healthcare environments is a plus.

• Experience building or scaling security and compliance programs within a growing SaaS organization is preferred.

• Familiarity with cloud-native environments, particularly Azure and Kubernetes/AKS, as well as DevSecOps and security automation, is advantageous.

• Experience leading a small security/compliance team or cross-functional security initiatives is a plus.

• Relevant certifications such as CCSFP, CISSP, CISM, or HCISPP are preferred.

• Strong organizational skills, sound judgment, ownership, and the ability to operate effectively in a growing and evolving environment are essential.

• This is a fully remote role for candidates based in the United States and is not eligible for sponsorship.

Benefits

• Base salary range of $130,000–$150,000, with final compensation determined by experience, skills, and organizational needs.

• Fully remote position within the United States.

• Opportunity to lead and mature security, privacy, and compliance programs within a growing healthcare technology organization.

• High-impact role with significant cross-functional exposure across Engineering, Product, SRE, IT, Legal, and customer-facing teams.

• Opportunity to lead HITRUST certification and build scalable, proactive security and compliance capabilities.

• Meaningful leadership responsibility, including team development and mentorship.

• Opportunity to influence security architecture, compliance automation, incident management, and organizational risk strategy.