Director, Security, Data & AI Governance

MHC; Burnsville (MN); Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Workplace Flexibility

401(k) Plan

Medical Plans

Dental and Vision Plans

EAP

Generous PTO

Job summary

MHC is seeking a hands-on Director, Security and Compliance to own security, data governance, and AI governance. You will manage SOC 2 Type II, work with auditors, and build controls across HIPAA, PCI, and GDPR/CCPA.

This role combines policy writing, risk management, and cross‑functional collaboration with engineering, product, and sales from a remote US-based location. You will lead the security program, governance framework, and vendor risk while ensuring audit readiness and customer trust in

Qualifications

• Direct, hands-on experience operating and renewing a SOC 2 Type II program.
• Experience with data governance practices, retention, access reviews, and privacy regulations (CCPA/GDPR).
• Familiarity with AI governance concepts and frameworks.

Responsibilities

• Own SOC 2 Type II renewal and serve as primary liaison to the audit firm.
• Mature the control environment to reduce manual evidence collection and keep controls audit-ready year-round.
• Develop and operate controls for SOC 2 Type II, HIPAA, PCI, GDPR/CCPA with auditors.
• Expand attestation footprint (ISO 27001, HIPAA, GDPR/CCPA).
• Lead security reviews during the sales cycle and respond to due‑diligence requests.
• Maintain security policy suite, risk register, and incident response plan; run tabletop exercises.
• Establish data classification, retention, and access-control standards across production systems.
• Partner with engineering on least-privilege access and encryption standards.

Skills

SOC 2 Type II

Data governance

AI governance

Auditing

Policy writing

Access reviews

Security program

Education

Bachelor’s degree in Computer Science or Information Security

Tools

ISO 27001

Job description

MHC is seeking a hands-on Director, Security and Compliance to own security, data governance, and AI governance. You will manage SOC 2 Type II, work with auditors, and build controls across HIPAA, PCI, and GDPR/CCPA.

This role combines policy writing, risk management, and cross‑functional collaboration with engineering, product, and sales from a remote US-based location. You will lead the security program, governance framework, and vendor risk while ensuring audit readiness and customer trust in