Privacy & Security Engagement Officer

This is a fully remote position, open to applicants in California, +3 more states.

📋 Description

• Collaborates with Health Plans or Shared Services to convert privacy, security, artificial intelligence (AI), business continuity, and related requirements from client contracts, laws, and regulations into effective enterprise controls.

• Fosters trusted relationships with Health Plan leadership and key stakeholders to guarantee contract assurance, readiness reviews, Request for Proposal (RFP) support, timely fulfillment of deliverables, compliance reporting, and ongoing improvement.

• Initiates early engagement with Enterprise Privacy, Security and Risk Management (EPSRM) to enhance visibility and influence throughout the organization.

• Leads EPSRM interactions with Health Plans or Shared Services to ensure that privacy, security, AI, and business continuity requirements are comprehended, executed, and monitored effectively.

• Analyzes and translates regulatory, contractual, and legal requirements into operational controls, guiding stakeholders on compliance expectations.

• Validates and oversees compliance evidence, deliverables, and audit preparedness, including responses to regulators, clients, and both internal and external auditors.

• Cultivates and sustains strong relationships with leadership, operational teams, and regulators to eliminate barriers, resolve issues, and support consistent compliance practices.

• Monitors regulatory, legislative, and contract changes, evaluates their organizational impact, and communicates necessary actions while aiding scalable control updates.

• Ensures the accuracy and completeness of privacy, security, AI, and business continuity documentation, including plans, attestations, questionnaires, and related submissions.

• Enhances enterprise engagement processes by promoting standardized procedures, governance practices, templates, and continuous improvement initiatives.

• Assists in new market entries, RFP responses, contract renewals, and business expansion by providing specialized EPSRM subject matter expertise.

• Identifies risks and control deficiencies, recommends mitigation strategies, and contributes to the advancement of compliance maturity across the enterprise.

• Performs additional duties as assigned and adheres to all policies and standards.

⛳️ Requirements

• Bachelor's Degree in Information Security, Information Systems, Risk/Compliance, Business, Law, or Compliance-related fields, or equivalent experience as a paralegal required.

• Master's Degree in a related discipline preferred.

• Juris Doctor (JD) preferred.

• 7+ years of experience in privacy/security, risk, or compliance within the managed care and payer/health plan industry required.

• 5+ years of experience in identifying, analyzing, and communicating security or privacy control requirements within the context of health plan operations, processes, and systems required.

• Proven experience in assessing and interpreting contract and regulatory requirements, translating them into control-based operational capabilities, and ensuring delivery across multiple stakeholders required.

• Experience in interpreting, implementing, and ensuring compliance with State & Federal Privacy, Cybersecurity & AI laws & regulations applicable to healthcare payors and related business entities (i.e., HIPAA/HITECH, CCPA/CPRA, CPA, CTDPA, CAIA, VPA, COPPA, TCPA, etc.) required.

• Licenses/Certifications: CISSP / CISM Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM) required upon hire.

• Certified Information Privacy Professional (CIP), Artificial Intelligence Governance Professional (AIGP), Certified Risk and Information Systems Control (CRISC), or Certified Information Security Analyst (CISA) or equivalent preferred.

🏝️ Benefits

• Competitive salary.

• Health insurance coverage.

• 401K and stock purchase plans.

• Tuition reimbursement program.

• Paid time off plus holidays.

• Flexible work arrangements, including remote, hybrid, field, or office work schedules.