Senior Manager, Security & Compliance

About the Company

A fast-growing healthcare technology company is transforming how employers manage and finance high-cost specialty care.

The company partners with large employers and healthcare organizations to improve access to complex therapies while reducing costs and bringing greater transparency to healthcare spending. As the business continues to scale, security, compliance, and enterprise readiness are becoming increasingly important.

About the Role

The company is hiring a Senior Manager, Security & Compliance to lead the next phase of its security and compliance program.

The business already has an established compliance foundation, including SOC 2 Type II and HIPAA-aligned controls, and is now looking for an experienced security leader to mature the program further, with HITRUST certification as an immediate priority.

This is a highly hands-on individual contributor role. You’ll set the direction of the security and compliance program while remaining involved in execution, including audits, certifications, policies, controls, security questionnaires, vendor risk, and client security requirements.

You’ll work closely with Engineering, Operations, and commercial teams while managing external security partners.

What You’ll Accomplish

Lead the compliance program

• Own HITRUST certification from initial gap assessment through control mapping, remediation, and assessor management.
• Own SOC 2 Type II end-to-end, including evidence collection, auditor management, and remediation.
• Maintain HIPAA security and privacy controls, policies, and BAA requirements.

Build and strengthen the security program

• Assess the company’s existing security posture and create a prioritized roadmap for improvements.
• Implement new security controls, policies, and processes across the organization.
• Partner with Engineering on controls across the company’s cloud infrastructure and data stack.
• Evaluate new vendors and technologies, including AI tools, and manage ongoing third-party risk.

Own customer and partner security requirements

• Complete security questionnaires, RFP security sections, and control reviews.
• Evaluate security requirements and obligations within customer and partner agreements.
• Build scalable processes and a response library as the company grows.
• Represent the company in conversations with enterprise customer and partner security teams.

Manage security partnerships and reporting

• Select and manage external security partners.
• Keep leadership informed on security posture, compliance progress, risk, and areas requiring investment.

What You Bring

• 7+ years of experience across healthcare information security, GRC, IT audit, or related disciplines.
• Direct ownership of at least one complete SOC 2 Type II audit cycle.
• Deep familiarity with SOC 2, HIPAA, and HITRUST.
• Experience building a security/compliance program from scratch or owning one end-to-end within a startup or growth-stage environment.
• Hands-on experience completing security questionnaires and working directly with enterprise customer or health plan security teams.
• Strong understanding of PHI and HIPAA Security and Privacy requirements within B2B healthcare.
• Enough technical depth in cloud infrastructure and modern data environments to review controls and work effectively with engineers.
• Ability to operate independently and stay hands-on while making strategic security decisions for the organization.

Bonus Points

• Personally led a company through HITRUST certification.
• Background in HealthTech, digital health, healthcare benefits, health plans, or self-funded employer solutions.
• ISO 27001 experience.
• Experience with compliance automation platforms such as Vanta, Drata, Secureframe, or similar tools.
• CISSP, CISA, CISM, or CRISC certification.