First Security Engineer at Aradigm - Build HITRUST Program

Aradigm; New York (NY); Remote; USD 140,000 - 175,000; Full time

Benefits offered by this job

Health coverage

Equity

401(k)

Job summary

Aradigm is hiring its first Security Engineer to own our HITRUST r2 and SOC 2 Type 2 programs, write policies, implement controls, and gather evidence for audits. You will partner with engineering, data, legal, and an external IT partner in a hands-on role with broad scope.

This fully remote, US-based position offers high autonomy, flat structure, and opportunities to shape security culture while preparing for future leadership paths; travel to NYC 3–5 times per year is expected.

Qualifications

• HITRUST r2 ownership and SOC 2 evidence management.
• Familiarity with HIPAA Security and Privacy Rules and BAAs.
• Ability to write policies, implement controls, collect evidence and answer audits.

Responsibilities

• Lead HITRUST r2 and SOC 2 Type 2 programs and expand scope over time.
• Answer security questionnaires and diligence requests from employers and health plans.
• Review security designs for new systems and audit GCP implementations.
• Operate DLP tooling and AI governance controls for data access.
• Assess vendors and subprocessors; align BAAs with data flow.
• Collaborate with IT to deploy endpoint security and incident response planning.

Skills

HITRUST r2

SOC 2

IAM policy

GCP security

DLP governance

AI governance

Security incident response

Vendor risk management

Security awareness training

Cloud security auditing

Education

CCSFP

CISSP

CISA

GCP security certification

Tools

Google Cloud Platform

EDR tooling

IAM policy review

Job description

First Security Engineer at Aradigm - Build HITRUST Program — Remote

This is a high-impact, high-autonomy founding security role at an early-stage healthcare tech company — a genuinely rare opportunity to build a compliance program from near-scratch rather than inheriting someone else's tech debt. Reporting directly to the Head of Engineering with no security team above or below you signals broad scope and real ownership.

Compensation analysis: $140K–$175K is competitive for a mid-to-senior security engineer in the US, though slightly below what FAANG or large healthtech firms pay for equivalent HITRUST/SOC 2 expertise (often $180K–$220K+). The equity component partially offsets this, and the public benefit corporation structure may appeal to mission-driven candidates.

• End-to-end HITRUST r2 certification ownership — one of the most valued credentials in health IT compliance
• AI governance and LLM data access controls — a rapidly growing, high-demand specialization
• GCP cloud security architecture review and IAM policy auditing
• Customer-facing security communication — valuable for future CISO or VP-Security trajectories

Green flags: Flat structure, clear success metrics (certifications), early-stage equity, mission-driven mission, and the ability to shape the entire security culture.

Watch for: No defined growth ladder ("no levels") means promotion is informal — you'll need to self-advocate. As the sole security hire, burnout risk is real during certification crunch periods. Ensure the equity terms and vesting schedule are clearly negotiated before accepting.

The Role

Aradigm is a public benefit corporation helping people with cancer and other serious diseases access life-changing cell and gene therapies that can potentially cure them. We do this through a new coverage model for self-insured employers and health plans, and our customers trust us with their members' sensitive health data.

We're hiring our first Security Engineer — one of the first engineering hires after our Head of Engineering — to own security and compliance across the company. You'll own our HITRUST r2 and SOC 2 Type 2 programs and be the person customers and partners talk to when they want to know how we protect their data. This is a hands-on role: you'll write the policy, implement the control, collect the evidence, and answer the questionnaire.

You'll report to our Head of Engineering and work closely with our engineering and data teams, legal counsel, and an external IT partner. There's no security department to inherit, and we're a flat organization with no levels: you grow here by taking on more scope and owning outcomes. We work remotely within the US, with a strong preference for the East Coast and travel to our NYC office 3–5 times a year.

What Success Looks Like

Success in this role means obtaining and maintaining our HITRUST r2 and SOC 2 Type 2 certifications.

You won't do it alone. Your first six months focus on honing our processes and procedures, with our assessor, an external penetration testing team, and other security vendors helping you move faster.

What You'll Do

• Own HITRUST and SOC 2: lead our HITRUST r2 and SOC 2 Type 2 programs, including expanding HITRUST scope over time, and run the evidence, control testing, and remediation that keep both current year-round
• Own customer security reviews: answer security questionnaires, diligence requests, and audit asks from employers, health plans, and carriers; turn repeat questions into reusable, accurate answers
• Guide secure engineering: review security designs for new systems, audit our existing cloud (GCP) implementation, and give engineers clear, practical feedback rather than gatekeeping
• Run data loss prevention and AI governance: operate our DLP tooling and the controls around how AI tools and agents access sensitive data
• Manage vendor and third-party risk: assess vendors and subprocessors, and work with legal to confirm BAA terms match how data actually flows
• Partner with IT: work with our external IT team to make sure endpoint management, EDR, and other security tooling are deployed and configured correctly
• Build the program: write and maintain policies, run security awareness training, own incident response planning, and keep the risk register honest

Requirements

Must Haves

• Must be authorized to work in the United States; Aradigm does not sponsor work visas
• Because our work includes government programs such as Medicaid, you must pass a background check and federal exclusion and debarment screening at hire and annually, and comply with our data use agreements

Great to Haves

• 4–10 years of hands-on security and compliance experience, ideally in healthcare; experience in another highly regulated industry (financial services, insurance, government) also works
• You've taken an organization through HITRUST (r2 strongly preferred) or a comparable framework, and you've owned SOC 2 evidence and audits directly
• Working knowledge of HIPAA Security and Privacy Rules and what a BAA does and doesn't cover
• Comfortable in a cloud environment: you can read an IAM policy, review logging and network config, and spot a risky design
• Clear writer who can explain controls to an auditor, a customer's security team, and an engineer, each in their own terms
• A builder, not a box-checker: you prefer controls that work in practice over ones that only pass an audit
• Comfortable in ambiguous, fast-moving environments where you set the priorities

Nice to Haves

• Certifications such as CCSFP, CISSP, CISA, or a GCP security certification
• Experience with GCP specifically, and with Google Workspace security
• Experience governing AI tools, LLMs, or agent access to sensitive data
• Scripting ability (Python or similar) to automate evidence collection and checks
• Comfort using AI tools (Claude, Cursor, etc.) as a practical part of daily workflows

$140,000–$175,000 base salary, health coverage, equity, and 401(k). We're a flat organization, so where you start in this range depends on your experience and the impact we expect you to have from day one.

Is this role fully remote or is there an office requirement? The role is remote within the United States, with a strong preference for East Coast candidates. You'll be expected to travel to Aradigm's NYC office 3–5 times per year. Does Aradigm sponsor work visas for this position? No. Aradigm does not sponsor work visas, and you must be authorized to work in the United States to be eligible for this role. What is the salary range for the Security Engineer role? The base salary range is $140,000–$175,000 depending on experience and expected impact. The role also includes health coverage, equity, and a 401(k). Do I need prior HITRUST experience to apply? HITRUST r2 experience is strongly preferred — ideally having led an organization through the certification process. SOC 2 direct ownership is also listed as a key qualification, though experience with comparable frameworks from other regulated industries is considered. Is this a leadership role or an individual contributor position? This is a senior individual contributor role — Aradigm is a flat organization with no formal levels. You'll be the first and only security hire, owning the full program with support from external vendors, an IT partner, and the Head of Engineering.

Remote work & career advice that actually works.