Security and Compliance Manager

Rezilient Health; Deutschland; Remote; EUR 90,000 - 140,000; Full time

Benefits offered by this job

Stock options

Comprehensive medical package

Generous PTO & family leave

Job summary

Rezilient Health is seeking a Security and Compliance Manager to lead GRC efforts for our CloudClinic healthcare platform. You will own audits, certifications, vendor risk, and policy enforcement across product, engineering, clinical operations, and IT.

You will partner with product and engineering to embed security into the lifecycle, manage incident response from a governance perspective, and stay current with HIPAA/HITECH, SOC 2, HITRUST, and ISO 27001 standards.

Qualifications

• Bachelor’s degree in cybersecurity, IT, risk, or compliance or equivalent experience.
• 5–10 years of security/compliance experience in healthcare, digital health, or SaaS/cloud.
• Strong familiarity with frameworks such as SOC 2, HITRUST, HIPAA/HITECH, ISO 27001/27002, NIST CSF.
• Experience working cross-functionally with engineering, product, IT, and clinical/operational teams.
• Hands-on experience with audits, external assessors, and certification processes.
• Strong knowledge of third-party risk management, incident response, and security governance.
• Excellent communication skills with the ability to translate technical and compliance risks into business impact.
• Relevant certifications (CISSP, CISM, CISA, CRISC) strongly preferred.

Responsibilities

• Develop, implement, and maintain the security and compliance program aligned with company goals and regulatory requirements.
• Lead certification and attestation efforts, including SOC 2 audits, HITRUST readiness, and other healthcare/security frameworks.
• Develop and maintain security and compliance policies, standards, and procedures; ensure they are operationalized and enforced across the organization.
• Oversee governance activities including risk assessments, internal audits, compliance reviews, and reporting of KPIs/metrics to leadership.
• Own and manage the third-party/vendor risk management program, including security assessments, ongoing monitoring, and partnership with legal/procurement on contract requirements.
• Oversee incident response from a governance and compliance perspective, ensuring response plans are in place, coordinating cross-functional efforts, and managing regulatory reporting when required.
• Maintain and manage the enterprise risk register, including tracking remediation efforts and escalating risks appropriately.
• Coordinate and oversee security awareness and compliance training programs, ensuring effectiveness and adoption across the organization.
• Provide regular reporting to the CISO and executive team on security posture, compliance status, and risk landscape.
• Monitor the evolving regulatory and industry landscape (healthcare, privacy, SaaS/cloud) and ensure the organization adapts proactively.
• Partner closely with Product and Engineering teams to embed security and compliance into the product lifecycle.
• Lead or support security and compliance reviews of new features, infrastructure, and architecture decisions.
• Ensure adherence to secure development practices, data protection requirements, and regulatory considerations in platform design.
• Act as a key stakeholder in design reviews, threat modeling, and release readiness from a compliance standpoint.
• Work closely with Clinical Operations teams to maintain and evolve the compliance program for care delivery.
• Ensure workflows, protocols, and systems used in care delivery meet HIPAA/HITECH and other regulatory requirements.
• Support audits, documentation, and training related to clinical compliance and patient data handling.
• Partner with IT on clinic and corporate security, including device management, endpoint security, access controls, and software governance.
• Ensure consistent enforcement of security policies across physical clinics and distributed environments.
• Support implementation and monitoring of controls related to identity/access management, endpoint protection, and SaaS tools.
• Partner with Growth (Sales) and Client Success teams to support security and compliance needs throughout the customer lifecycle.
• Respond to security questionnaires, RFPs, and due diligence requests from prospective and existing clients.
• Act as a subject matter expert in sales cycles, helping articulate the company's security posture and build trust with buyers.
• Develop and maintain standardized security materials (e.g., trust center content, policies, certifications, FAQs) to streamline sales and client interactions.

Skills

Security governance

Regulatory compliance

Audits & certifications

Cross-functional leadership

Communication skills

Risk management

Vendor risk

Education

Bachelor's degree in cybersecurity/IT/risk/compliance

Tools

SOC 2

HIPAA/HITECH

HITRUST

ISO 27001/27002

NIST CSF

CISSP/CISM/CISA/CRISC

Job description

At Rezilient, we?re redefining primary care by making access to healthcare more convenient, timely, and seamless. Our innovative CloudClinic model combines virtual provider visits with cutting-edge technology to create a personalized digital healthcare experience that puts patients at the center of their care. By streamlining care delivery and continuously expanding specialty services, we empower our care team to focus on patient well-being while providing the most comprehensive and accessible care possible. As Rezilient scales, we are looking to add a Security and Compliance Manager to our growing team. This key member of the team will be responsible for executing and coordinating the company's security governance, risk, and compliance (GRC) functions. This role owns the operationalization of frameworks, certifications (SOC 2, HIPAA/HITECH, HITRUST, etc.), policies, audits, and vendor compliance. This role serves as a critical cross-functional bridge between security, product, engineering, clinical operations, and IT, ensuring that security and compliance are embedded into product development, care delivery, and internal systems from the ground up.

Key Responsibilities: Security Program & Compliance Management

• Develop, implement, and maintain the security & compliance program aligned with company goals and regulatory requirements (HIPAA, HITECH, HITRUST, SOC 2, etc.).
• Lead certification and attestation efforts, including SOC 2 audits, HITRUST readiness, and other healthcare/security frameworks.
• Develop and maintain security and compliance policies, standards, and procedures; ensure they are operationalized and enforced across the organization.
• Oversee governance activities including risk assessments, internal audits, compliance reviews, and reporting of KPIs/metrics to leadership.
• Own and manage the third-party/vendor risk management program, including security assessments, ongoing monitoring, and partnership with legal/procurement on contract requirements.
• Oversee incident response from a governance and compliance perspective, ensuring response plans are in place, coordinating cross-functional efforts, and managing regulatory reporting when required.
• Maintain and manage the enterprise risk register, including tracking remediation efforts and escalating risks appropriately.
• Coordinate and oversee security awareness and compliance training programs, ensuring effectiveness and adoption across the organization.
• Provide regular reporting to the CISO and executive team on security posture, compliance status, and risk landscape.
• Monitor the evolving regulatory and industry landscape (healthcare, privacy, SaaS/cloud) and ensure the organization adapts proactively.

Product & Engineering Collaboration

• Partner closely with Product and Engineering teams to embed security and compliance into the product lifecycle.
• Lead or support security and compliance reviews of new features, infrastructure, and architecture decisions.
• Ensure adherence to secure development practices, data protection requirements, and regulatory considerations in platform design (especially for PHI/PII handling).
• Act as a key stakeholder in design reviews, threat modeling, and release readiness from a compliance standpoint.

Clinical Operations Collaboration

• Work closely with Clinical Operations teams to maintain and evolve the compliance program for care delivery (both virtual and in-clinic).
• Ensure workflows, protocols, and systems used in care delivery meet HIPAA/HITECH and other regulatory requirements.
• Support audits, documentation, and training related to clinical compliance and patient data handling.

IT & Internal Security Coordination

• Partner with IT on clinic and corporate security, including device management, endpoint security, access controls, and software governance.
• Ensure consistent enforcement of security policies across physical clinics and distributed environments.
• Support implementation and monitoring of controls related to identity/access management, endpoint protection, and SaaS tools.

Growth (Sales) & Client Success Coordination

• Partner with Growth (Sales) and Client Success teams to support security and compliance needs throughout the customer lifecycle.
• Respond to security questionnaires, RFPs, and due diligence requests from prospective and existing clients.
• Act as a subject matter expert in sales cycles, helping articulate the company's security posture and build trust with buyers.
• Develop and maintain standardized security materials (e.g., trust center content, policies, certifications, FAQs) to streamline sales and client interactions.

Requirements

• Bachelor's degree in cybersecurity, IT, risk, or compliance (or equivalent experience) is required; advanced degree a plus.
• 5?10 years of experience in security/compliance in healthcare, digital health, or SaaS/cloud environments is required.
• Strong familiarity with frameworks such as SOC 2, HITRUST, HIPAA/HITECH, ISO 27001/27002, NIST CSF.
• Experience working cross-functionally with engineering, product, IT, and clinical/operational teams.
• Hands-on experience with audits, external assessors, and certification processes.
• Strong knowledge of third-party risk management, incident response, and security governance.
• Excellent communication skills with the ability to translate technical and compliance risks into business impact.
• Relevant certifications (CISSP, CISM, CISA, CRISC) strongly preferred.

Benefits

This opportunity offers the chance to shape the future of healthcare in a culture where your ideas and contributions have a meaningful impact on the organization's future. You'll be part of a supportive, collaborative, and diverse team, with competitive compensation and benefits that include generous PTO, paid family leave, comprehensive medical, dental, vision, and life insurance, as well as stock options.