Security & Compliance Lead: HITRUST & SOC 2

Leap Health, Inc.; New York, Northern (NY, KY); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Leap Health, Inc. is seeking a Senior Manager, Security & Compliance to lead the next phase of our security program. You will own HITRUST certification, SOC 2 Type II audits, and HIPAA controls, and shape a practical, scalable framework for the company.

This hands-on role requires writing policies, running audits, reviewing controls, and making governance calls with clients. You will partner with Engineering, Operations, and GTM teams, and manage our external security partner to protect PHI and

Qualifications

• 7+ years in healthcare information security, governance/risk/compliance (GRC), or IT audit with ownership of at least one full SOC 2 Type II cycle.
• Deep familiarity with SOC 2, HIPAA, and HITRUST; audit- and GRC-first approach to building a program.
• Experience building a security/compliance program from scratch or as an early security hire at a startup or growth-stage company.
• Hands-on experience completing security questionnaires and representing the company with enterprise or health plan security teams.
• Working knowledge of HIPAA Security and Privacy Rules and handling PHI in B2B healthcare.
• Technical depth in cloud infrastructures (GCP preferred) and modern data stacks to review controls with engineers.

Responsibilities

• Lead our compliance program, including HITRUST certification from kickoff to completion with gap assessments and remediation.
• Own SOC 2 Type II end-to-end, including evidence collection, auditor management, and closing gaps.
• Maintain HIPAA security and privacy controls, policies, and BAA obligations.

Skills

SOC 2 Type II

HIPAA

HITRUST

GRC

Audit

Cloud security (GCP)

Tools

Vanta

Drata

Secureframe

Job description

Leap Health, Inc. is seeking a Senior Manager, Security & Compliance to lead the next phase of our security program. You will own HITRUST certification, SOC 2 Type II audits, and HIPAA controls, and shape a practical, scalable framework for the company.

This hands-on role requires writing policies, running audits, reviewing controls, and making governance calls with clients. You will partner with Engineering, Operations, and GTM teams, and manage our external security partner to protect PHI and