About the company
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Manager of Security and Compliance based in United States.
This is a high-impact security and compliance leadership role within a growing healthcare SaaS environment. You will own the day-to-day execution and continued maturity of security, privacy, risk, and healthcare compliance programs. The role combines strategic program leadership with hands-on security, audit, incident response, and risk-management work. You will work closely with Engineering, Product, SRE, IT, Legal, and customer-facing teams to embed security into technology and business processes. A major priority will be leading HITRUST certification while strengthening HIPAA, SOC 2, privacy, and broader security controls.
Responsibilities
- Own and continuously mature security, privacy, and compliance programs covering HIPAA, SOC 2, HITRUST, and applicable healthcare privacy requirements
- Lead HITRUST certification end to end, including scoping, readiness assessments, evidence collection, assessor coordination, remediation, and corrective action plans
- Manage internal and external audits, risk assessments, penetration tests, security reviews, evidence collection, and remediation activities
- Build a path toward continuous, system-generated compliance
- Manage external security and compliance partners, including advisors, assessors, and penetration-testing providers
- Maintain the security and compliance roadmap
- Partner with Engineering, Product, Platform, SRE, and IT to integrate security into architecture, infrastructure, product development, and the software development lifecycle
- Establish security and PHI-handling standards and guardrails, including considerations for AI-assisted development
- Oversee critical controls including identity and access management, logging and monitoring, encryption, vulnerability management, data retention, data protection, and vendor risk
- Lead security incident response, including investigation, stakeholder communication, post-incident reviews, and corrective actions
- Maintain security policies, procedures, Business Associate Agreements, data-handling requirements, and breach-response plans
- Serve as the operational lead for HIPAA Security Rule obligations
- Support customer security reviews, due diligence, onboarding, and security and privacy requirements during contract negotiations
- Establish security and compliance metrics
- Lead security awareness and compliance training while managing, developing, and mentoring the security and compliance team
Requirements
- 7+ years of experience in information security, healthcare compliance, privacy, risk management, or a closely related discipline, preferably within healthcare SaaS or health technology
- Strong working knowledge of HIPAA, SOC 2, HITRUST, healthcare privacy requirements, and security control frameworks
- Demonstrated experience leading audits, risk assessments, compliance programs, remediation initiatives, and external security or compliance partners
- Proven experience serving as the accountable owner for at least one HITRUST certification, either i1 or r2
- Practical knowledge of cloud and SaaS security, identity and access management, vulnerability management, encryption, logging, data protection, and incident response
- Experience partnering with Engineering and Product teams to integrate security into technology architecture and development processes
- Experience with vendor risk management and third-party security assessments
- Strong communication skills
- Experience working with healthcare technology, electronic medical records, clinical systems, or sensitive healthcare data environments
- Experience in PACE, value-based care, Medicare/Medicaid, or other regulated healthcare environments is a plus
- Experience building or scaling security and compliance programs within a growing SaaS organization is preferred
- Familiarity with cloud-native environments, particularly Azure and Kubernetes/AKS, as well as DevSecOps and security automation, is advantageous
- Relevant certifications such as CCSFP, CISSP, CISM, or HCISPP are preferred
Conditions
- Base salary range of $130,000–$150,000, with final compensation determined by experience, skills, and organizational needs
- Fully remote position within the United States
- Opportunity to lead and mature security, privacy, and compliance programs within a growing healthcare technology organization
- This role is not eligible for sponsorship