Director, Compliance & AI Governance

AKASA; San Francisco (CA); On-site; USD 175,000 - 200,000; Full time

Benefits offered by this job

Flexible PTO

Health/dental/vision coverage

HSA employer contribution

Parental leave

Life insurance

Home office stipend

Cell phone/internet reimbursement

Commuting benefits

Company holidays

401(K)

Job summary

AKASA is transforming healthcare with AI-native solutions. The Director of Compliance & AI Governance will own our HITRUST, SOC 2, and HIPAA programs end to end, implement AI governance per NIST RMF, and drive policy lifecycle across the company.

This on-site role requires 3+ days/week at our South San Francisco HQ, with a small, high-leverage team and growth opportunities. You will lead cross-functional teams with Engineering, Product, and Legal to automate evidence collection, map controls,

Qualifications

• 8+ years in security compliance, GRC, or risk management with leadership experience.
• Hands-on with HITRUST CSF (r2 preferred), SOC 2 Type II, HIPAA, and AI governance like NIST AI RMF.
• Experience automating evidence collection and using AI tools to enhance compliance workflows.

Responsibilities

• Own compliance certifications end to end (HITRUST CSF, SOC 2 Type II, HIPAA) and pursue new attestations as needed.
• Define roadmaps and drive organization-wide alignment on regulatory requirements.
• Build AI governance programs with model risk assessments and policy documentation.
• Drive automation of governance tooling, evidence collection, and audit prep.
• Own policy lifecycle, exceptions, attestations, and version control; ensure practical policies.

Skills

HITRUST CSF

SOC 2 Type II

HIPAA Security & Privacy

AI governance

GRC tooling

Automation

Policy development

Tools

Vanta

Drata

Hyperproof

Okta

AWS

Job description

About AKASA

AKASA is building the future of healthcare by developing AI-native solutions for some of healthcare's most complex, consequential work. Our customers include the most innovative health systems in the country, like Cleveland Clinic, Mayo Clinic, NewYork-Presbyterian, Duke, Stanford, and Johns Hopkins. Our customer base represents 1 in 10 inpatient discharges across the United States and more than $180B+ in net patient revenue.

AKASA is building the future of healthcare by developing AI-native solutions for some of healthcare's most complex, consequential work. Our customers include the most innovative health systems in the country, like Cleveland Clinic, Mayo Clinic, NewYork-Presbyterian, Duke, Stanford, and Johns Hopkins. Our customer base represents 1 in 10 inpatient discharges across the United States and more than $180B+ in net patient revenue. Our products help health systems comprehensively capture and communicate the full patient clinical journey. By empowering health systems to streamline their operations, they can focus on what matters most - delivering quality patient care. We train internal models and build domain-specific harnesses to power our products and best capture clinical nuance for each customer. We hire people with high agency and good judgment. Everyone here is an owner and builder who is looking to help solve high stakes challenges every day. We have raised over $250M in funding from investors such as Andreessen Horowitz, BOND, and Coatue. Our deployments have been recognized nationally as "one of the most comprehensive real-world uses of GenAI in healthcare finance to date" (link). Some of our recent recognitions include being named one of America's Top Startup Employers 2026 by Forbes, a Top Healthcare Technology Company of 2026 by Healthcare Technology Report, the #1 most promising healthcare RCM startup of 2025 by Black Book Market Research, and we have been certified as a "Great Place to Work" for the past 6 years in a row.

About The Role

We're looking for a strategic, automation-minded Director of Compliance & AI Governance to own and evolve AKASA's compliance program as we scale. This role is ideal for someone who has led compliance in a healthcare SaaS or AI environment and wants to build a modern, engineering-forward program rather than a paperwork factory. You'll own our HITRUST, SOC 2, and HIPAA programs end to end, operationalize emerging AI governance frameworks like the NIST AI RMF, and drive the policy lifecycle across the company. The ideal candidate treats compliance as a product: automated evidence collection, continuous control monitoring, and policies people actually read and follow. You'll join a small, high-leverage team with immediate ownership and room to build. You thrive in a fast-paced startup environment and are agile with an ownership mindset.

This is an on-site position that requires 3+ days a week in our South San Francisco HQ.

What You'll Do

• Own AKASA's compliance certification portfolio end to end (including HITRUST CSF, SOC 2 Type II, and HIPAA) from control design and implementation through evidence collection, audit coordination, and remediation. Evaluate and pursue new certifications and attestations (such as ISO 27001, ISO 42001, and HITRUST AI) as customer and market needs evolve.
• Define compliance roadmaps and ensure org-wide adoption, driving cross-functional alignment and accountability on regulatory requirements.
• Build our AI governance program grounded in the NIST AI RMF, partnering with Engineering, Product, and Legal to establish model risk assessments, AI use policies, and documentation that meets enterprise health system expectations.
• Drive compliance automation as a first principle: implement and optimize GRC and continuous control monitoring tooling, automate evidence collection across our stack (Okta, Google Workspace, Kandji/Iru, SentinelOne, Nightfall, AWS), and use AI tools to streamline policy drafting, control mapping, and audit preparation.
• Own the full policy lifecycle, including authoring, review cadences, exception handling, attestation campaigns, and version control; ensuring policies are clear, practical, and mapped to the frameworks we certify against.
• Be the compliance face of AKASA for customers and prospects: lead security and compliance questionnaire responses, support enterprise sales cycles, manage customer audits, and maintain trust artifacts including BAAs, our trust center, and shared assessments. Find ways to automate these processes using AI first tooling.
• Oversee vendor and third-party risk management, the annual risk assessment, security awareness and HIPAA training programs, and incident response documentation and tabletop exercises in partnership with Security and IT.
• Partner with Legal and Security leadership on all security-related contractual obligations.

Skills & Qualifications

• 8+ years experience in security compliance, GRC, or risk management, including 2+ years leading a team or function. Healthcare SaaS, health tech, or AI startup experience strongly preferred.
• Deep, hands-on expertise across HITRUST CSF (r2 preferred), SOC 2 Type II, HIPAA Security and Privacy Rules, and emerging AI governance frameworks like NIST AI RMF. You've run certification and audit cycles from start to finish and know how to translate AI governance standards into real controls for a company building on PHI.
• An automation-first instinct: hands-on experience with GRC and continuous control monitoring platforms (Vanta, Drata, Hyperproof, or similar), evidence collection automation, and a track record of using AI tools (ChatGPT, Claude) to push the boundaries of what a lean compliance function can do.
• End-to-end policy ownership: drafting, cross-framework mapping, and running review/exception/attestation cycles.
• Comfort in front of customers: enterprise security questionnaires, sales-cycle support, BAA/security terms negotiation alongside Legal, and managing customer audits.

We'd Love To See One Or More Of

• Direct experience achieving or maintaining ISO 27001, ISO 42001, or HITRUST AI certifications.
• Familiarity with the technical side of a modern security stack (Okta, MDM platforms like Kandji/Iru, SentinelOne, Nightfall, AWS) and the ability to partner credibly with Security and IT on control implementation.
• Experience with privacy regulations beyond HIPAA, such as CCPA/CPRA, state health data laws, or GDPR.
• Implementing Compliance Automation Tools and Trust Centers like Drata or Vanta.
• Scripting or low-code automation skills (Python, Zapier, Tray.io) for building compliance workflows.
• Relevant certifications such as CISSP, CISA, CIPP/US, HCISPP, or HITRUST CCSFP.

What We Offer

• Flexible paid time off (PTO)
• Expansive coverage for health, dental, and vision
• Employer contribution to Health Savings Accounts (HSA)
• Generous parental leave policy
• Full employee coverage for life insurance
• Home office stipend
• Cell phone/internet reimbursement
• Commuting benefits
• Company-paid holidays
• 401(K) plan

Compensation

• Based on market data and other factors, the salary range for this position is $175,000 - $200,000 + Equity. However, a salary higher or lower than this range may be appropriate for a candidate whose qualifications differ meaningfully from those listed in the job description.

The above represents the expected salary range for this job requisition. Ultimately, in determining your pay, we'll consider your location, experience, and other job-related factors.

We're committed to doing the best work of our lives, together.

AKASA is a proud equal opportunity employer and we believe that a diverse and inclusive workforce is an imperative. We welcome people of different backgrounds, genders, races, ethnicities, abilities, sexual orientations, and perspectives, just to name a few. We do not discriminate based upon any protected class and we encourage candidates of all identities and backgrounds to apply. AKASA considers qualified applicants regardless of criminal histories in accordance with the San Francisco Fair Chance Ordinance. AKASA is committed to providing reasonable accommodations for candidates with disabilities in our recruiting process. If you need any assistance or accommodations due to a disability, please let us know at [e-mail].