Hybrid Security & Compliance Analyst: SOC/HITRUST Expert

Parachute Health, LLC; United States; Hybrid; USD 80,000 - 135,000; Full time

Benefits offered by this job

Remote-first culture

Health insurance

401(k) plan

Annual bonus up to 15%

Learning and development stipend

Job summary

Parachute Health is transforming post-acute care as a leading digital ordering platform for medical equipment and supplies. This hybrid role combines security compliance with hands-on technical work, owning the end-to-end audits (SOC 1, SOC 2, HITRUST CSF) and driving remediation across our cloud stack.

You'll implement security controls, develop policies, and manage compliance automation using Drata and SafeBase, while coordinating with vendors and customers on assessments and inquiries.

Qualifications

• 4+ years in security compliance and hands-on security.
• Experience with SOC 1/ SOC 2 and HITRUST audits.
• Knowledge of HIPAA Security & Privacy.
• Experience with vulnerability scanning and remediation.
• Familiarity with AWS security concepts.
• Ability to write clear policies and remediation tickets.

Responsibilities

• Own SOC 1, SOC 2, HITRUST CSF, and HITRUST AI audits end-to-end: scoping, evidence collection, auditor coordination, and findings remediation
• Develop, update, revise, and implement compliance policies, procedures, and practices for security frameworks (HIPAA, HITRUST, SOC) as well as general compliance and operations
• Manage our compliance automation and trust platforms (Drata, SafeBase), including control monitoring and responses to customer security questionnaires
• Coordinate with external vendors and clients to gather information needed for compliance reviews, validations, and audits
• Run third-party/vendor risk assessments and respond to customer security assessments and external inquiries
• Deliver HIPAA and security awareness training and measure control effectiveness through internal audits
• Run the vulnerability management program: scanning, triage, prioritization, and driving remediation with engineering teams
• Investigate and remediate security findings across our AWS environment (EKS, WAF, Shield, CloudFront, IAM) and SaaS stack
• Review external attack surface findings and implement fixes from CSP headers to TLS configuration
• Support security incident response: log analysis, forensic evidence collection, and containment
• Support fraud and forensic investigations authentication log analysis, targeted data extraction, and evidence preservation in support of legal and compliance matters
• Improve our security tooling and automate evidence collection, using scripting (Python, Bash) where manual work can be eliminated

Skills

Security compliance

HIPAA security

Vulnerability management

AWS security

Audit coordination

Tools

Drata

SafeBase

Job description

Parachute Health is transforming post-acute care as a leading digital ordering platform for medical equipment and supplies. This hybrid role combines security compliance with hands-on technical work, owning the end-to-end audits (SOC 1, SOC 2, HITRUST CSF) and driving remediation across our cloud stack.

You'll implement security controls, develop policies, and manage compliance automation using Drata and SafeBase, while coordinating with vendors and customers on assessments and inquiries.