Manager – Security and Compliance

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of and continuously enhance IntusCare's security and compliance programs in alignment with HIPAA, SOC 2, HITRUST, and relevant privacy standards.

• Spearhead the complete process of IntusCare's HITRUST certification, including scoping, readiness evaluations, evidence gathering, coordination with assessors, and corrective action planning.

• Oversee both internal and external audits, risk evaluations, security assessments, penetration testing, evidence collection, and remediation activities.

• Manage relationships with external security and compliance partners, guiding their scope and priorities, and ensuring that findings lead to effective remediation.

• Keep the security and compliance roadmap updated, clearly assigning ownership and outlining resolution strategies for risks, vulnerabilities, audit findings, and control deficiencies.

• Collaborate with Engineering, Product, Platform, SRE, and IT teams to embed security into the architecture, infrastructure, product development, and software development lifecycle (SDLC).

• Supervise access management, logging and monitoring, encryption, vulnerability management, data retention policies, and vendor risk controls.

• Direct security incident response efforts, including investigation, communication, post-incident evaluations, and corrective measures.

• Maintain security policies, procedures, Business Associate Agreements, data handling protocols, and breach response strategies.

• Act as the primary contact for HIPAA Security Rule obligations and assist with HIPAA and HITRUST attestations.

• Support customer security assessments, due diligence, onboarding processes, and security/privacy requirements during contract negotiations.

• Develop security and compliance metrics and provide leadership with insights into risks, incidents, vulnerabilities, remediation progress, and audit preparedness.

• Facilitate security awareness and compliance training while managing, developing, and mentoring the security and compliance team.

• Establish a proactive, measurable, and audit-ready security and compliance function integrated within IntusCare's healthcare SaaS operations.

• Successfully achieve HITRUST certification with all findings addressed and manage security incidents consistently through a unified incident response process.

⛳️ Requirements

• A minimum of 7 years of experience in information security, healthcare compliance, privacy, or risk management, ideally within healthcare SaaS or health technology sectors.

• In-depth knowledge of HIPAA, SOC 2, HITRUST, healthcare privacy standards, and security control frameworks.

• Demonstrated experience in leading audits, risk assessments, compliance programs, and remediation efforts, including directing external advisors and assessors.

• Proven track record of managing at least one HITRUST certification (i1 or r2) from start to finish as the accountable owner, covering scoping, evidence gathering, assessor management, and corrective action planning.

• Practical experience in cloud/SaaS security, identity and access management, vulnerability management, encryption, logging, data protection, and incident response.

• Experience collaborating with Engineering and Product teams to integrate security into technology and development workflows.

• Knowledge of vendor risk management and conducting third-party security assessments.

• Excellent communication skills with the ability to convey security and regulatory requirements to both technical and non-technical audiences.

• Experience with healthcare technology, EMRs, clinical systems, or healthcare data environments.

• Preferred: experience with PACE, value-based care, Medicare/Medicaid, or regulated healthcare settings.

• Preferred: experience in developing or scaling security and compliance programs within a growing SaaS organization.

• Preferred: expertise in securing cloud-native environments, including Azure and Kubernetes/AKS, as well as knowledge of DevSecOps and security automation.

• Preferred: experience in leading a small security/compliance team or managing cross-functional security initiatives.

• Preferred: relevant certifications such as CCSFP, CISSP, CISM, or HCISPP.

• Must reside in the United States.

• This position does not offer sponsorship eligibility.

🏝️ Benefits

• Comprehensive health, dental, and vision insurance.

• Competitive salary with performance-based bonuses.

• Generous paid time off and holiday policies.

• Professional development opportunities and continuous learning.

• Collaborative and supportive work environment.