Security & Compliance Manager

FamilyWell Health & FamilyWell Academy; United States; On-site; USD 110,000 - 190,000; Full time

Job summary

Remote DXB, a US-based startup, seeks a security compliance professional to own day-to-day operations of the security program. You will coordinate HIPAA SRA, vendor risk reviews, and incident response while guiding policy development and automation efforts.

You will partner with a fractional CISO and CPO, manage MDM/BYOD compliance, and help drive AI security guardrails in a fast-paced remote environment.

Qualifications

• 3–6+ years in security compliance, IT security, or GRC roles.
• Direct experience with HIPAA Security Rule requirements, SRA, and vendor/BAA risk reviews.
• Comfortable running a security calendar and tracking remediation items to closure across multiple stakeholders.
• Experience partnering with a fractional/contractor CISO, MSP, or outside security advisor.
• Strong documentation and project management habits.
• Ability to work independently in a fast-paced, remote startup environment.

Responsibilities

• Own day-to-day management of the security program: SRA cadence, pen test coordination and remediation tracking, phishing simulations, annual security awareness calendar.
• Draft Policies & Procedures for CISO and leadership review/approval.
• Lead vendor security assessments and BAA audits.
• Own MDM/BYOD device compliance monitoring.
• Serve as day-to-day lead on incident/breach response.
• Support rollout of identity and access management improvements.
• Prepare recurring board-level risk and compliance status reporting with CPO and contractor CISO.
• Evaluate and roll out compliance automation tooling (e.g., Drata or Vanta).
• Track open items from SRAs, audits, and vendor reviews to closure.
• Help define and maintain AI security guardrails.
• Document and record all security program controls, risks, incidents, audits, and roadmap initiatives.

Skills

Security governance

Documentation

Project management

Independent work

Security risk management

Tools

Drata

Vanta

MDM/endpoint tools

Google Workspace security controls

Job description

Responsibilities

• Own day-to-day management of the security program: Security Risk Assessment (SRA) cadence, penetration test coordination and remediation tracking, phishing simulations, and the annual security awareness training calendar.
• Draft Policies & Procedures (P&Ps) for CISO and leadership review/approval.
• Lead vendor security assessments and Business Associate Agreement (BAA) audits.
• Own MDM/BYOD device compliance monitoring.
• Serve as day-to-day lead on incident/breach response.
• Support rollout of identity and access management improvements.
• Partner with the CPO and contractor CISO to prepare recurring board-level risk and compliance status reporting.
• Own compliance-automation tooling evaluation and rollout (e.g., Drata or Vanta).
• Track open items from SRAs, audits, and vendor reviews to closure.
• Help define and maintain AI security guardrails.
• Maintain detailed documentation and records of all security program controls, risks, incidents, vendor audits, and roadmap initiatives.

Requirements

• 3–6+ years of experience in security compliance, IT security, or GRC (governance, risk, and compliance) roles.
• Direct experience with HIPAA Security Rule requirements, Security Risk Assessments, and vendor/BAA risk reviews.
• Comfortable running a security calendar and tracking remediation items to closure across multiple stakeholders.
• Experience partnering with a fractional or contractor CISO, MSP, or outside security advisor.
• Strong documentation and project management habits.
• Ability to work independently in a fast-fast paced, remote startup environment.

Preferred Qualifications

• Direct experience preparing for or achieving SOC2 or HITRUST certification.
• Familiarity with compliance automation platforms (Drata, Vanta, or similar).
• Experience with MDM/endpoint tools, Google Workspace security controls (DLP, Vault), and password manager rollouts.
• Experience in an early-stage or high-growth startup.
• Familiarity with AI governance/security considerations for tools used with PHI.

About the Company

FamilyWell Health is an AI-enabled mental health startup dedicated to addressing the women's mental health crisis by seamlessly embedding high-quality, equitable, and affordable mental health care into women's health practices and health systems.