Compliance and Security Director

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of Bluesight’s compliance framework, risk management program, and customer-oriented regulatory assurances.

• Oversee the SOC 2 compliance initiative and manage the yearly audit and certification process.

• Maintain the risk register, conduct annual risk evaluations, manage third-party/vendor risks, and oversee business continuity/disaster recovery and policy lifecycles.

• Interact with existing and prospective hospital clients regarding intricate security and IT inquiries and concerns.

• Manage the customer security review process, which includes completing security and IT questionnaires and addressing technical and contract-related compliance matters.

• Evaluate and document compliance controls within AWS cloud infrastructure.

• Collaborate with Engineering to verify configurations, access controls, logging, encryption, and shared-responsibility boundaries for SOC 2 and HIPAA evidence.

• Work alongside IT on endpoint protection, IAM, and access reviews, while also managing audit evidence.

• Establish and enhance the compliance automation platform.

• Perform internal audits, provide employee training, and offer guidance on security and compliance issues.

• Develop and communicate compliance strategies related to healthcare data security and AI.

• Document processes and decision-making and lead presentations and discussions for diverse audiences.

• Collaborate with the CTO/Security Officer and the Security Engineering team; report directly to the General Counsel.

⛳️ Requirements

• Proven experience in developing, implementing, and monitoring internal practices for SOC2, HIPAA, NIST, or ISO compliance standards.

• Understanding of hospital security operations and ability to effectively represent Bluesight's security posture and operational maturity to clients.

• Proficient knowledge of cloud infrastructure and security, particularly AWS, including IAM, networks, encryption and key management, logging/monitoring, and the shared responsibility model.

• Capability to interpret architecture diagrams and challenge control claims.

• Familiarity with AI governance, including NIST AI RMF or vendor AI risk, and a keen interest in AI regulation.

• Proficient in clearly conveying complex and critical information to a wide-ranging audience.

• Subject matter expertise in security best practices with the ability to recommend risk treatments and escalate matters for acceptance.

• Eagerness to learn about unfamiliar domains and collaborate across departments.

• Autonomy and initiative in driving projects to completion among multiple stakeholders.

• Strong familiarity with data protection, privacy, and compliance automation or GRC platforms such as Vanta and Drata.

🏝️ Benefits

• Competitive salary.

• Unlimited vacation days.

• Generous insurance coverage.

• 401(k) program with a company match.

• Fun, collaborative culture.

• Opportunities to tackle large-scale problems within a tech-forward, rapidly growing company.

• Significant influence on what we work on, how it operates, and how it is constructed.

• Space for creativity and the freedom to carve your own path.

• Trust in your sense of ownership.

• Colleagues from whom you will learn, who will challenge you, and who are eager to learn from you.

• Eligibility for an annual discretionary bonus.

• Health and wellness benefits.

• Leave benefits.

• Retirement benefits.