Security & Compliance Manager

OpenKrill; United States; In loco; USD 120.000 - 180.000; Tempo pieno

Descrizione del lavoro

Healthie in the United States seeks a Manager, Security and Compliance to drive core portions of the security and compliance program. You will own audits, the third-party risk program, customer-focused security work, and the policies and controls that underpin all of it.

This builder’s role involves determining what to fix first, designing the process, selecting tooling, and running it until it works, collaborating with engineering, IT, operations, legal, sales, and executive offices.

Competenze

• 7+ years of professional experience in security/compliance, with SOC 2 or HIPAA program ownership.
• Experience building and running programs like third-party risk, audit readiness, questionnaire response, policy management.

Mansioni

• Own third-party audits (SOC 2, HIPAA, HITRUST) and close findings.
• Run third-party risk management, vendor intake, security assessments, BAAs, remediation tracking, periodic reassessment.
• Lead customer trust activities: security questionnaires, customer audits, trust center content, security reviews in deals.

Conoscenze

Security governance

GRC

Third-party risk

HIPAA

SOC 2

Privacy

Executive communication

Formazione

Bachelor's degree in a relevant field

Strumenti

Vanta

Descrizione del lavoro

Our Mission

Healthie is an AI-Native, ONC Certified EHR for modern outpatient healthcare.

Healthie is proud to power clinically excellent healthcare for over 40,000 providers who deliver clinically excellent healthcare - longitudinal and collaboratively, with patient and provider experiences at the center. Both healthcare and technology are undergoing unparalleled industry innovation, and it’s incredible to see the momentum - from consumers, from providers, and from reimbursement for this type of healthcare - grow exponentially.

We provide the powerful infrastructure every care delivery organization needs. On the surface this includes EHR, Scheduling, Engagement, Billing, Data, and much more. Underneath the iceberg are thousands of configurations, settings, widgets, automations, and limitless capabilities because we are an API-first platform. Our fully brandable platform makes it easy for clinics and organizations of any size to scale and never reach a limit.

Today, over 3 billion API calls are made to Healthie every month, as thousands of organizations who work with more than 21 million patients in total, rely on Healthie to deliver clinically excellent healthcare in over 35 specialties, from behavioral healthcare to complex chronic care management and personalized medicine.

We believe in the power of technology to improve access to healthcare and we’re building the rails that make this a reality. We work fast and with quality because we provide business-critical, healthcare-critical software that clinicians and patients need for a better healthcare system. We’re customer-obsessed, operate with lightning-fast processes and responses, and always share our product roadmap publicly- so customers can see what we’re building, and remain relentlessly focused on how care gets delivered.

Healthie is backed by leading investors, and while we've $42M raised to date, more importantly, we operate with fiscal responsibility and have been profitable for more than half of our time as a company. We know that building an ONC-Certified EHR is a lifetime’s body of work, and we are here to build for our customers forever.

Learn more at https://www.gethealthie.com/

About the role

As Manager, Security and Compliance, you'll run meaningful portions of the day-to-day security and compliance program at Healthie as a core member of Healthie’s Security and Compliance Team. You will own components of our audits, our third-party risk program, our customer-facing security work, and the policies and controls underneath all of it.

This is a builder's role. Some of what we need exists and needs to be run better. Some of it doesn't exist yet. You'll help decide what to fix first, design the process, pick or configure the tooling, and then run it until it works without you watching. You'll work with engineering, IT, operations, legal, sales, and the offices of the CEO and CTO, and report to Healthie’s VP of Security & Compliance. Many of the people you depend on won't report to you, so you'll need to get things done through influence and clear communication.

The work will include:

• Our third-party audits, including SOC 2, the annual HIPAA assessment, and HITRUST. You will scope the work, assign evidence to control owners, and close findings.
• Running the third-party risk management program. That covers vendor intake and tiering, security assessments, contract requirements such as BAAs, remediation tracking, and periodic reassessment. Vendors that touch PHI get the most attention.
• Owning the customer trust function: security questionnaires, customer audits, trust center content, and security reviews during enterprise deals. You'll join sales calls when a prospect's security team wants to talk to someone who knows the answers, and you'll refine the existing answer library so most questionnaires never need you.
• Contribute to the policy set, the control framework, and the risk register. You keep them accurate and mapped across frameworks, and you make sure people can follow them.
• Administering Vanta and the workflows around it, so continuous monitoring actually leads to fixes instead of a growing list of failing tests.
• Help with AI governance and data privacy practices. That includes reviews of AI features and AI vendors, privacy-by-design input on product work, and tracking state privacy laws, GDPR, and the EU AI Act as they apply to us.
• Running intake and triage for every request that comes to security and compliance. You set the priorities, answer what you can, and route the rest to the right owner with a deadline.
• Reporting program health to the VP and to leadership. You should be able to say where we are exposed, what is late, and what it will take to fix it.

What a quarter may look like: An audit in some phase of planning, fieldwork, or remediation. A dozen vendor reviews, two of which turn into real conversations about whether we should use that vendor at all. A handful of enterprise deals where security is on the critical path. One new process you are building from scratch, maybe an AI vendor review or a better reassessment cycle, and one existing process you are making faster. Somewhere in there, a policy update that needs sign-off from people who are busy.

You will have access to some of the company's most sensitive information, including data entrusted to our protection by customers and their clients. You must follow access rules exactly, raise your own mistakes before anyone else finds them, and keep confidence when it would be easier not to. At this level, other people will model their behavior on yours, so you set the standard.

This position will suit someone who has worked inside a security GRC or third-party risk team, ideally in healthcare or health tech, and has run pieces of a program rather than just supported them. Your background might be in IT, program management, privacy, or consulting. We care more about what you have built and run than about the path you took to get here.

About you

• You must be based in the United States. (On occasion you may need to see protected health information [PHI], and our customers have contracts that forbid access to such information from outside the United States.)
• You have roughly 7 or more years of professional experience, with at least 3 in security compliance, GRC, third-party risk, or privacy. You have owned a SOC 2 or HIPAA program, or a major part of one, at a company that handles regulated data.
• You have built or rebuilt a process that other people now depend on. Third-party risk, audit readiness, questionnaire response, policy management: we don't mind which, as long as you can explain what you changed and why it worked.
• You must be an excellent and fluent writer, speaker, and communicator in English, and able to do all of it without the aid of AI. You can compress a dense control requirement into two sentences a customer's security team will accept. You can write an exception that still holds up when someone audits it next year. And you can explain a risk to an executive without making it sound smaller or bigger than it is.
• You understand the security and compliance challenges a modern healthcare software company faces, including the ones that come from customers, regulators, and the vendors we rely on.
• You use AI as a working tool. You use it to draft documentation, map controls, and work through dense regulatory text, and you check its output before it goes anywhere. You can tell when a model is confidently wrong, and you would rather rewrite something than pass along slop. You also have opinions on how a company like ours should govern its own use of AI.
• You can run a program across teams that do not report to you. You keep work organized and visible, you follow up without being asked, and people trust your plans because they tend to come true.
• You are interested in software, technology, and its impact on humans. You ask why a control exists before you enforce