Lead Security & Compliance Analyst U.S. Remote

Parachute Health, LLC; United States; Remote; USD 80,000 - 135,000; Full time

Benefits offered by this job

Remote-first culture

Health insurance

401(k) plan

Annual bonus up to 15%

Learning and development stipend

Job summary

Parachute Health is transforming post-acute care as a leading digital ordering platform for medical equipment and supplies. This hybrid role combines security compliance with hands-on technical work, owning the end-to-end audits (SOC 1, SOC 2, HITRUST CSF) and driving remediation across our cloud stack.

You'll implement security controls, develop policies, and manage compliance automation using Drata and SafeBase, while coordinating with vendors and customers on assessments and inquiries.

Qualifications

• 4+ years in security compliance and hands-on security.
• Experience with SOC 1/ SOC 2 and HITRUST audits.
• Knowledge of HIPAA Security & Privacy.
• Experience with vulnerability scanning and remediation.
• Familiarity with AWS security concepts.
• Ability to write clear policies and remediation tickets.

Responsibilities

• Own SOC 1, SOC 2, HITRUST CSF, and HITRUST AI audits end-to-end: scoping, evidence collection, auditor coordination, and findings remediation
• Develop, update, revise, and implement compliance policies, procedures, and practices for security frameworks (HIPAA, HITRUST, SOC) as well as general compliance and operations
• Manage our compliance automation and trust platforms (Drata, SafeBase), including control monitoring and responses to customer security questionnaires
• Coordinate with external vendors and clients to gather information needed for compliance reviews, validations, and audits
• Run third-party/vendor risk assessments and respond to customer security assessments and external inquiries
• Deliver HIPAA and security awareness training and measure control effectiveness through internal audits
• Run the vulnerability management program: scanning, triage, prioritization, and driving remediation with engineering teams
• Investigate and remediate security findings across our AWS environment (EKS, WAF, Shield, CloudFront, IAM) and SaaS stack
• Review external attack surface findings and implement fixes from CSP headers to TLS configuration
• Support security incident response: log analysis, forensic evidence collection, and containment
• Support fraud and forensic investigations authentication log analysis, targeted data extraction, and evidence preservation in support of legal and compliance matters
• Improve our security tooling and automate evidence collection, using scripting (Python, Bash) where manual work can be eliminated

Skills

Security compliance

HIPAA security

Vulnerability management

AWS security

Audit coordination

Tools

Drata

SafeBase

Job description

Parachute Health is transforming post-acute care as the leading digital ordering platform for medical equipment and supplies. We connect major health systems, health plans, and suppliers to help patients get the life-saving products they need at home. Since launching, we've connected 300,000+ clinicians and 3,000+ supplier locations across all 50 states and helped 15M+ patients. What started as a DME ePrescribing tool has become the order management platform of choice for home medical equipment.

Join our team and make a difference in patient care.

About the Role

This is a hybrid role: roughly half security compliance and audit, half hands-on technical security. You'll own our compliance audit cycle end-to-end (SOC 1, SOC 2, HITRUST CSF, HITRUST AI), and you'll also work directly on the technical side: vulnerability management, security findings remediation, cloud security reviews, and third-party risk.

Responsibilities

Compliance & Audit

• Own SOC 1, SOC 2, HITRUST CSF, and HITRUST AI audits end-to-end: scoping, evidence collection, auditor coordination, and findings remediation
• Develop, update, revise, and implement compliance policies, procedures, and practices for security frameworks (HIPAA, HITRUST, SOC) as well as general compliance and operations
• Manage our compliance automation and trust platforms (Drata, SafeBase), including control monitoring and responses to customer security questionnaires.
• Coordinate with external vendors and clients to gather information needed for compliance reviews, validations, and audits
• Run third-party/vendor risk assessments and respond to customer security assessments and external inquiries
• Deliver HIPAA and security awareness training and measure control effectiveness through internal audits

Technical Security

• Run the vulnerability management program: scanning, triage, prioritization, and driving remediation with engineering teams
• Investigate and remediate security findings across our AWS environment (EKS, WAF, Shield, CloudFront, IAM) and SaaS stack
• Review external attack surface findings (e.g., SecurityScorecard) and implement fixes from CSP headers to subresource integrity to TLS configuration
• Support security incident response: log analysis, forensic evidence collection, and containment
• Support fraud and forensic investigations authentication log analysis, targeted data extraction, and evidence preservation in support of legal and compliance matters
• Improve our security tooling and automate evidence collection, using scripting (Python, Bash) where manual work can be eliminated

What We're Looking For

• 4+ years combined experience across security compliance/GRC and hands-on technical security
• Direct experience supporting SOC 1/SOC 2 and/or HITRUST audits — you've been through at least one full audit cycle
• Working knowledge of HIPAA Security and Privacy requirements
• Hands-on experience with vulnerability scanning and remediation, and comfort reading technical findings (CVEs, misconfigurations, cloud security issues)
• Familiarity with AWS security concepts (IAM, security groups, logging, WAF)
• Ability to write clear policies and procedures and equally clear remediation tickets

Nice to Have

• Experience with compliance automation platforms (Drata, Vanta, or similar)
• Experience in healthcare or another regulated industry
• Certifications such as CISSP, CISA, CRISC, HITRUST CCSFP, or CISM
• Experience with SIEM tools and log analysis
• Experience with forensic log analysis, fraud investigations, or supporting legal/eDiscovery requests
• Medical, Dental, and Vision Coverage: Comprehensive plans with options for low-to-no-cost premiums.
• Employer HSA Contribution: Company-funded contributions to your Health Savings Account.
• 401(k) Retirement Plan
• Equity Incentive Plan
• Annual Company-Wide Bonus: Opportunity for up to 15% bonus based on company performance.
• Remote-First Culture: We are remote-first with a dedicated NYC office and reimbursement options for co-working spaces.
• Flexible Vacation Policy
• Summer Fridays: 5 additional Fridays off during the summer (separate from PTO).
• Home Office and Wellness Stipend
• Monthly Internet Stipend
• Annual Learning and Development Stipend

Base Salary Band (based on experience and level)

$80,000 - $135,000

California job applicants may access the Notice of Collection of Personal Information and Privacy Policy with information and rights required by the California Privacy Rights Act (CPRA) the linkhere .

We are proud to be an equal opportunity employer that does not discriminate on the basis of actual or perceived race, color, creed, religion, national origin, ancestry, citizenship status, age, sex or gender (including pregnancy, childbirth related medical conditions and lactation), gender identity or gender expression (including transgender status), sexual orientation, marital status, military service and veteran status, disability, genetic information, or any other characteristic protected by applicable federal, state, or local laws and ordinances.

This role is not eligible for employer visa sponsorship. Applicants must be legally authorized to work in the United States at the time of application and for the duration of employment. The Company does not sponsor employment authorization for this position.

Apply for this job

*

indicates a required field

First Name *

Last Name *

Preferred First Name

Email *

Phone

Country *

Phone *

Location (City) *

Resume/CV *

Enter manually

Accepted file types: pdf, doc, docx, txt, rtf

Enter manually

Accepted file types: pdf, doc, docx, txt, rtf

LinkedIn Profile

In which state do you live? * Select...

Will you now or in the future require sponsorship for employment in the United States? * Select...