Manager of Security and Compliance

Collab Capital; United States; Remote; USD 130,000 - 150,000; Full time

Job summary

IntusCare is seeking a Manager of Security & Compliance to lead our healthcare security program, drive HITRUST certification, and coordinate audits across HIPAA, SOC 2, and privacy requirements. The role partners with Engineering, Product, and IT to embed security into the SDLC and product development while managing third-party assessors and incident response.

The position is fully remote in the United States, with a focus on measurable risk reduction and compliance maturity.

Qualifications

• 7+ years of experience in information security, healthcare compliance, privacy, or risk management.
• Strong knowledge of HIPAA, SOC 2, HITRUST, healthcare privacy requirements, and security control frameworks.
• Proven experience leading audits, risk assessments, compliance programs, and remediation activities, including directing external advisors and assessors.
• Proven experience leading at least one HITRUST certification (i1 or r2) end to end as the accountable owner, including scoping, evidence collection, assessor management, and corrective action plans.
• Practical understanding of cloud/SaaS security, identity and access management, vulnerability management, encryption, logging, data protection, and incident response.
• Experience partnering with Engineering and Product teams to incorporate security into technology and development processes.
• Experience with vendor risk management and third-party security assessments.
• Strong communication skills with the ability to translate security and regulatory requirements for technical and non-technical audiences.
• Experience working with healthcare technology, EMRs, clinical systems, or healthcare data environments.

Responsibilities

• Own and continuously improve Intus Care's security and compliance programs across HIPAA, SOC 2, HITRUST, and applicable privacy requirements.
• Lead HITRUST certification end to end, including scoping, readiness assessment, evidence collection, assessor coordination, and corrective action plans.
• Lead internal and external audits, risk assessments, security reviews, penetration tests, evidence collection, and remediation efforts, moving evidence from point-in-time collection toward continuous, system-generated compliance.
• Manage external security and compliance partners, including the advisory firm supporting audit preparation, HITRUST assessors, and penetration testers.
• Maintain the security and compliance roadmap, ensuring risks, vulnerabilities, audit findings, and control gaps have clear owners and resolution plans.
• Partner with Engineering, Product, the Platform team, SRE, and IT to integrate security into architecture, infrastructure, product development, and the SDLC, including security and PHI-handling standards and guardrails for AI-assisted development.
• Oversee critical controls including access management, logging and monitoring, encryption, vulnerability management, data retention, and vendor risk.
• Lead security incident responses, including investigation, communication, post-incident reviews, and corrective actions, as part of Intus Care's unified incident management process across SRE, Security, and IT.
• Maintain security policies, procedures, BAAs, data handling requirements, and breach response plans.
• Serve as the day-to-day lead for HIPAA Security Rule obligations, supporting the HIPAA Security Official and partnering with the Privacy Officer on HIPAA and HITRUST attestations.
• Support customer security reviews, due diligence, onboarding, and security/privacy requirements during contract negotiations.
• Establish security and compliance metrics and provide leadership with visibility into risks, incidents, vulnerabilities, remediation progress, and audit readiness.
• Lead security awareness and compliance training, and manage, develop, and mentor the security and compliance team.

Skills

information security

healthcare compliance

risk management

audits & remediation

cloud security

identity & access management

incident response

vendor risk management

communication

healthcare data environments

Tools

Azure

Kubernetes

Job description

About IntusCare:

IntusCare is the only end-to-end ecosystem built specifically to help Programs of All-Inclusive Care for the Elderly (PACE) programs deliver exceptional care, strengthen financial performance, and stay compliant. IntusCare replaces outdated technology and manual workarounds with purpose-built solutions for care coordination, risk adjustment, population health, and utilization management. We empower teams to take control of their operations and improve outcomes for dual-eligible seniors- some of the most socially vulnerable and clinically complex individuals in the US healthcare system.

Role Overview:

Intus Care is seeking a Manager, Security & Compliance to lead the day-to-day execution and continued maturity of our security, privacy, and healthcare compliance program. This individual will own key compliance programs, security governance, risk management, audit readiness, and incident response while partnering closely with Engineering, Product, SRE, IT, Legal, and customer-facing teams. We are looking for someone who combines strong healthcare compliance knowledge with practical security experience and is comfortable being hands-on in a growing healthcare SaaS organization. The right candidate can translate regulatory and security requirements into practical controls, processes, and measurable outcomes.

Key Responsibilities:

• Own and continuously improve Intus Care's security and compliance programs across HIPAA, SOC 2, HITRUST, and applicable privacy requirements.

• Lead Intus Care's HITRUST certification end to end, including scoping, readiness assessment, evidence collection, assessor coordination, and corrective action plans.

• Lead internal and external audits, risk assessments, security reviews, penetration tests, evidence collection, and remediation efforts, moving evidence from point-in-time collection toward continuous, system-generated compliance.

• Manage Intus Care's external security and compliance partners, including the advisory firm supporting audit preparation, HITRUST assessors, and penetration testers. Direct their scope and priorities, hold them accountable to deliverables, ensure their findings translate into owned remediation, and keep advisory and assessment roles independent.

• Maintain the security and compliance roadmap, ensuring risks, vulnerabilities, audit findings, and control gaps have clear owners and resolution plans.

• Partner with Engineering, Product, the Platform team, SRE, and IT to integrate security into architecture, infrastructure, product development, and the SDLC, including security and PHI-handling standards and guardrails for AI-assisted development.

• Oversee critical controls including access management, logging and monitoring, encryption, vulnerability management, data retention, and vendor risk.

• Lead security incident responses, including investigation, communication, post-incident reviews, and corrective actions, as part of Intus Care's unified incident management process across SRE, Security, and IT.

• Maintain security policies, procedures, Business Associate Agreements (BAAs), data handling requirements, and breach response plans.

• Serve as the day-to-day lead for HIPAA Security Rule obligations, supporting Intus Care's designated HIPAA Security Official and partnering with the Privacy Officer on HIPAA and HITRUST attestations.

• Support customer security reviews, due diligence, onboarding, and security/privacy requirements during contract negotiations.

• Establish security and compliance metrics and provide leadership with visibility into risks, incidents, vulnerabilities, remediation progress, and audit readiness.

• Lead security awareness and compliance training, and manage, develop, and mentor the security and compliance team.

Requirements

• 7+ years of experience in information security, healthcare compliance, privacy, or risk management, preferably within healthcare SaaS or health technology.

• Strong knowledge of HIPAA, SOC 2, HITRUST, healthcare privacy requirements, and security control frameworks.

• Proven experience leading audits, risk assessments, compliance programs, and remediation activities, including directing external advisors and assessors.

• Proven experience leading at least one HITRUST certification (i1 or r2) end to end as the accountable owner, including scoping, evidence collection, assessor management, and corrective action plans.

• Practical understanding of cloud/SaaS security, identity and access management, vulnerability management, encryption, logging, data protection, and incident response.

• Experience partnering with Engineering and Product teams to incorporate security into technology and development processes.

• Experience with vendor risk management and third-party security assessments.

• Strong communication skills with the ability to translate security and regulatory requirements for technical and non-technical audiences.

• Experience working with healthcare technology, EMRs, clinical systems, or healthcare data environments.

Preferred Qualifications

• Experience with PACE, value-based care, Medicare/Medicaid, or regulated healthcare environments.

• Experience building or scaling security and compliance programs in a growing SaaS company.

• Experience securing cloud-native environments (Azure and Kubernetes/AKS preferred), including DevSecOps and security automation.

• Experience leading a small security/compliance team or cross-functional security initiatives.

• Relevant certifications such as CCSFP, CISSP, CISM, or HCISPP.

What Success Looks Like

The Manager, Security & Compliance will help build a security and compliance function that is proactive, measurable, audit-ready, and integrated into how Intus Care builds and operates its products. In the first year, success includes achieving HITRUST certification with findings remediated and running security incidents consistently through the unified incident process. Success in this role means maintaining strong audit and regulatory readiness, proactively identifying and reducing risk, driving vulnerabilities and findings through remediation, improving security visibility across the organization, and establishing security as a trusted partner to Engineering, Product, customers, and the business. Ultimately, this role will help ensure Intus Care can continue to innovate and scale while protecting sensitive healthcare information and maintaining the trust of our customers and the participants they serve.

Compensation

The base salary range for this role is 130K-150K. We expect the ideal candidate to fall near the midpoint of this range, though final compensation will be determined based on experience, skills, and organizational needs.

Work location:

This is a fully remote role based in the United States.

Sponsorship:

This position is not eligible for sponsorship.