Senior Security & Compliance – Healthcare

• Own the security and compliance roadmap, including risk prioritization, remediation tracking, and follow-through
• Establish and maintain HIPAA-related policies, procedures, control requirements, and supporting evidence
• Review cloud infrastructure, access controls, secrets management, and other technical safeguards with the Platform Engineer
• Define technical control requirements, partner with the Platform Engineer on implementation and operation, and independently verify effectiveness
• Review patient-data flows, vendors, AI tools, and LLM-related data risks
• Set requirements for AI agents and tools accessing data, systems, and production environments
• Lead responses to customer security questionnaires and coordinate audit or external-review preparation
• Establish incident response and escalation procedures and help coordinate significant security-event responses
• Regularly review the Platform Engineer’s security work, mentor them, and identify gaps early
• Maintain records of findings, decisions, exceptions, control owners, and remediation progress
• Review the current environment in the first 30 days, identify high-priority gaps, clarify control ownership, and establish a remediation plan
• Within 90 days, assign owners and evidence to core HIPAA-related policies and controls and establish a risk and control-review cadence

• Senior-level healthcare security and compliance experience, including substantial HIPAA expertise
• Verifiable examples of security or compliance programs, safeguards, or reviews led
• Hands-on technical security knowledge across cloud infrastructure, access control, secrets, and data protection
• Ability to assess a real technical environment, not only review policies
• Experience establishing or improving security practices in a small or growing organization
• Ability to translate risks and requirements into controls engineers can implement and operate
• Experience guiding engineers while independently assessing whether their controls work
• Clear written communication about risks, decisions, priorities, and practical next steps
• Judgment about what to address immediately, what to plan for, and when to escalate
• Knowledge of HIPAA and healthcare data security
• Knowledge of Azure cloud and AKS/Kubernetes security
• Knowledge of access and secrets management
• Knowledge of patient-data flows and technical safeguards
• Knowledge of vendor and AI-tool risk
• Knowledge of customer security reviews
• Knowledge of control evidence and audit preparation
• Knowledge of incident response
• Knowledge of security roadmap prioritization
• SOC 2 or HITRUST experience is nice to have
• Azure security experience is nice to have
• Experience building a program at an early-stage startup is nice to have
• Experience assessing AI/LLM vendors and agent access to sensitive data is nice to have
• Attendance during approximately 6:00 PM–12:00 AM IST collaboration window is required
• Approximately 50 hours per week commitment

• Fully remote work
• Equipment allowance
• Direct access to the founder and Head of Engineering
• Significant ownership of the security and compliance foundations of an AI-native healthcare company
• Competitive compensation, based on demonstrated expertise and experience