Security & Compliance Leader (HIPAA, SOC 2, HITRUST) — Equity

Collectly, Inc.; Northern (KY); Hybrid; USD 190,000 - 220,000; Full time

Benefits offered by this job

Unlimited PTO

Health coverage

Equity opportunities

401(k) with company match

Student loan support

Competitive compensation

Job summary

Collectly, Inc. is seeking a security and compliance leader to own end-to-end program delivery, taking over from CTO and building a scalable function.

You’ll automate evidence, prune controls, and handle customer questions directly rather than routing to engineering. You’ll lead SOC 2, HITRUST, HIPAA programs, AI governance, and privacy efforts, coordinating with DevOps and vendors on BAAs, risk reviews, and incident responses.

Qualifications

• Extensive experience in security compliance or GRC, including healthcare PHI handling.
• Experience owning SOC 2 and HITRUST audits.
• Strong HIPAA fluency across Security, Privacy, and Breach Notification rules.
• Hands-on with Vanta or equivalent compliance automation platforms.
• Ability to interpret frameworks and apply them without a playbook.

Responsibilities

• Own customer-facing security and compliance end-to-end.
• Automate evidence gathering, prune unnecessary controls, and answer customer questions directly.
• Lead audits, certifications, and risk management programs.
• Coordinate with DevOps and platform engineers on security controls and architecture.
• Manage BAAs, vendor risk, and subprocessor notices.
• Develop and maintain policies, training, and incident response processes.
• Drive AI governance and privacy program initiatives.

Skills

Security compliance

GRC

SOC 2 owner

HITRUST owner

HIPAA fluency

Vanta familiarity

Compliance automation

Frameworks mastery

Customer-facing prose

Threat modeling

DevOps collaboration

PCI DSS experience

Tools

Archer

ProcessUnity

Venminder

Job description

Collectly, Inc. is seeking a security and compliance leader to own end-to-end program delivery, taking over from CTO and building a scalable function.

You’ll automate evidence, prune controls, and handle customer questions directly rather than routing to engineering. You’ll lead SOC 2, HITRUST, HIPAA programs, AI governance, and privacy efforts, coordinating with DevOps and vendors on BAAs, risk reviews, and incident responses.