Senior Security & Compliance – Healthcare

This is a fully remote position, open to applicants in India.

📋 Description

• Take charge of the security and compliance roadmap, which includes risk prioritization, tracking remediation, and ensuring follow-through.

• Develop and uphold policies, procedures, control requirements, and supporting documentation related to HIPAA.

• Collaborate with the Platform Engineer to assess cloud infrastructure, access controls, secrets management, and other technical protections.

• Define technical control requirements, work with the Platform Engineer on both implementation and operation, and independently verify their effectiveness.

• Analyze patient-data flows, vendor interactions, AI tools, and risks associated with LLM-related data.

• Set criteria for AI agents and tools that access data, systems, and production environments.

• Lead the responses to customer security questionnaires and facilitate the preparation for audits or external reviews.

• Create incident response and escalation procedures, and assist in coordinating responses to significant security events.

• Regularly evaluate the security work of the Platform Engineer, mentor them, and proactively identify gaps.

• Maintain comprehensive records of findings, decisions, exceptions, control owners, and the progress of remediation efforts.

• In the first 30 days, review the existing environment, pinpoint high-priority gaps, clarify control ownership, and develop a remediation plan.

• Within 90 days, assign ownership and evidence to essential HIPAA-related policies and controls, and implement a risk and control review schedule.

⛳️ Requirements

• Extensive senior-level experience in healthcare security and compliance, with significant expertise in HIPAA.

• Proven examples of security or compliance programs, safeguards, or reviews that you have led.

• Practical technical security knowledge encompassing cloud infrastructure, access control, secrets management, and data protection.

• Capability to evaluate a real technical environment, rather than just reviewing policies.

• Experience in establishing or enhancing security practices within a small or growing organization.

• Proficiency in converting risks and requirements into actionable controls for engineers to implement and manage.

• Experience in guiding engineers while independently verifying the functionality of their controls.

• Strong written communication skills regarding risks, decisions, priorities, and actionable next steps.

• Good judgment on what requires immediate attention, what should be planned for, and when to escalate issues.

• In-depth knowledge of HIPAA and healthcare data security.

• Familiarity with Azure cloud and AKS/Kubernetes security.

• Understanding of access and secrets management.

• Knowledge of patient-data flows and technical safeguards.

• Insight into vendor risks and AI-tool assessments.

• Familiarity with customer security reviews.

• Knowledge of control evidence and audit preparation processes.

• Understanding of incident response protocols.

• Experience in prioritizing security roadmap initiatives.

• SOC 2 or HITRUST experience is a plus.

• Azure security experience is beneficial.

• Previous experience in building a program at an early-stage startup is advantageous.

• Experience in evaluating AI/LLM vendors and managing their access to sensitive data is a plus.

• Availability for collaboration during the window of approximately 6:00 PM–12:00 AM IST is required.

• Commitment of approximately 50 hours per week is expected.

🏝️ Benefits

• Fully remote work environment.

• Equipment allowance provided.

• Direct access to the founder and Head of Engineering.

• Significant ownership in the security and compliance foundations of an AI-native healthcare company.

• Competitive compensation based on demonstrated expertise and experience.