Security & Compliance Manager

FamilyWell, Inc.; United States; Remote; USD 132,000 - 140,000; Full time

Job summary

FamilyWell Health is seeking a Security & Compliance Manager to own the day-to-day security program, drive risk assessments, and coordinate audits in a fast-paced, remote startup environment.

You will partner with the CPO and contractor CISO to advance SOC2/HITRUST readiness, implement Drata or Vanta, and improve identity and access management across the platform.

Qualifications

• 3–6+ years in security compliance, IT security, or GRC.
• Direct HIPAA Security Rule experience and vendor/BAA risk reviews.
• Able to manage security calendar and remediation tracking.
• Experience with fractional/contractor CISO, MSP, or external security advisor.
• Strong documentation and project management.
• Ability to work independently in a fast-paced remote startup.

Responsibilities

• Manage day-to-day security program activities and SRA cadence.
• Draft Policies & Procedures for CISO and leadership.
• Lead vendor security assessments and BAA audits.
• Own MDM/BYOD compliance monitoring with IT and MSP.
• Serve as day-to-day incident/breach response lead.
• Support IAM improvements including SSO and password manager.
• Prepare board-level risk and compliance status reports.
• Evaluate and rollout compliance automation tools (Drata or Vanta).
• Track open items from audits and vendor reviews to closure.
• Define AI security guardrails for PHI handling.

Skills

Security compliance

HIPAA Security Rule

Security risk assessments

Vendor/BAA risk reviews

Documentation & PM

Independent remote work

Tools

Drata

Vanta

MDM/endpoint tools

Google Workspace security

Job description

FamilyWell Health is an AI-enabled mental health startup dedicated to addressing the women’s mental health crisis by seamlessly embedding high-quality, equitable, and affordable mental health care into women’s health practices and health systems. Our comprehensive virtual care model delivers evidence-based mental health services across the full reproductive lifecycle, from fertility through menopause, using the proven Collaborative Care Model (CoCM).

Our AI-enabled platform integrates coaching, therapy, psychiatry, and care coordination services directly into clinical workflows, making mental health care accessible, affordable, and insurance-covered. With 95% of patients experiencing clinical improvement within four months, FamilyWell is addressing one of healthcare’s most underserved areas while building a financially sustainable model for provider partners.

Following our recent Series A raise, we are expanding nationally and seeking exceptional talent to join our mission-driven team. Learn more at www.familywellhealth.com.

FamilyWell is scaling a HIPAA-regulated, AI-enabled care platform, and our security program has outgrown what our CPO and contractor CISO can manage day-to-day. We're hiring a Security & Compliance Manager to own the operational backbone of our security and compliance program — running the security calendar, tracking risk assessment and pentest remediation to closure, managing vendor/BAA risk, and building toward a formal compliance certification (SOC2 or HITRUST, timing dependent on feasibility). You'll work closely with our CPO (Security Officer) and our contractor CISO, who will continue to own governance, sign-off, and board-level risk reporting, while you own the day-to-day execution that makes that reporting possible.

Key Responsibilities & Duties

• Own day-to-day management of the security program: Security Risk Assessment (SRA) cadence, penetration test coordination and remediation tracking, phishing simulations, and the annual security awareness training calendar.
• Draft Policies & Procedures (P&Ps) for CISO and leadership review/approval, and keep documentation current as the org and regulatory landscape evolve (e.g., the 2025 HIPAA Security Rule overhaul).
• Lead vendor security assessments and Business Associate Agreement (BAA) audits across FamilyWell's vendor ecosystem.
• Own MDM/BYOD device compliance monitoring, partnering with the IT Systems Administrator and our MSP on enrollment and endpoint security status.
• Serve as day-to-day lead on incident/breach response, escalating to the CPO and contractor CISO per FamilyWell's response plan.
• Support rollout of identity and access management improvements, including SSO and a company-wide password manager.
• Partner with the CPO and contractor CISO to prepare recurring board-level risk and compliance status reporting, including a forward-looking roadmap.
• Own compliance-automation tooling evaluation and rollout (e.g., Drata or Vanta) as FamilyWell works toward a SOC2 or HITRUST-ready posture.
• Track open items from SRAs, audits, and vendor reviews to closure (e.g., encryption gaps, audit-log access, policy sign-off) using FamilyWell's Security Program Tracker.
• Help define and maintain AI security guardrails (e.g., PHI handling policy for Claude/Cowork and other AI tools) as the platform and AI usage scale.
• Maintain detailed documentation and records of all security program controls, risks, incidents, vendor audits, and roadmap initiatives.

Minimum Qualifications

• 3–6+ years of experience in security compliance, IT security, or GRC (governance, risk, and compliance) roles.
• Direct experience with HIPAA Security Rule requirements, Security Risk Assessments, and vendor/BAA risk reviews — ideally in healthcare or another regulated industry.
• Comfortable running a security calendar and tracking remediation items to closure across multiple stakeholders.
• Experience partnering with a fractional or contractor CISO, MSP, or outside security advisor, and translating technical risk into clear, non-technical reporting for leadership or a board.
• Strong documentation and project management habits.
• Ability to work independently in a fast-paced, remote startup environment.

Nice-to-Haves

• Direct experience preparing for or achieving SOC2 or HITRUST certification.
• Familiarity with compliance automation platforms (Drata, Vanta, or similar).
• Experience with MDM/endpoint tools, Google Workspace security controls (DLP, Vault), and password manager rollouts.
• Experience in an early-stage or high-growth startup, comfortable building process from scratch.
• Familiarity with AI governance/security considerations for tools used with PHI.

Compensation Range: $132,000-$140,000

U.S. Standard Demographic Questions

We invite applicants to share their demographic background. If you choose to complete this survey, your responses may be used to identify areas of improvement in our hiring process.

How would you describe your gender identity? Select...

How would you describe your racial/ethnic background? Select...

How would you describe your sexual orientation? Select...

Do you identify as transgender? Select...

Do you have a disability or chronic condition (physical, visual, auditory, cognitive, mental, emotional, or other) that substantially limits one or more of your major life activities, including mobility, communication (seeing, hearing, speaking), and learning? Select...

Are you a veteran or active member of the United States Armed Forces? Select...

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in FamilyWell’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.