Security Lead & IT Operations Chief (HIPAA/SOC2)

NexHealth, Inc.; San Francisco (CA); On-site; USD 160,000 - 200,000; Full time

Benefits offered by this job

Stock options

Unlimited PTO

Medical, Vision, Dental insurance

Job summary

NexHealth, Inc. in San Francisco, CA, seeks a Security Lead to own governance, compliance, IT operations, vendor security, and incident response—establishing the function, embedding strong practices, and partnering with engineering, legal, and leadership.

This player-coach role requires hands-on execution in year one and the build-out of a security program aligned with cross-functional teams.

Qualifications

• 8+ years of security experience with leadership at a program level.
• Built security programs from near-zero baselines and led external audits end-to-end.
• Background in software engineering to read PRs and review cloud configs.

Responsibilities

• Own security governance, compliance, and IT programs end-to-end.
• Serve as Information and Privacy Officer for SOC 2 and HIPAA; manage audits.
• Set security standards across application, cloud, logging, and access controls.
• Build and grow the IT/workforce security program and training.
• Own vendor security lifecycle and customer-facing trust artifacts.
• Lead incident response in Officer capacity and coordinate with counsel.
• Manage risk register, privacy operations, BC/DR, and cyber insurance relations.
• Hire staff-level IC in year one and scale the function.

Skills

Security governance

Incident response

Audit liaison

Vendor security

Cloud security (AWS)

Engineering collaboration

Team building

Staff-level hiring

Tools

SIEM

MDR

IDS/IPS

WAF

DLP

Vulnerability scanners

Job description

NexHealth, Inc. in San Francisco, CA, seeks a Security Lead to own governance, compliance, IT operations, vendor security, and incident response—establishing the function, embedding strong practices, and partnering with engineering, legal, and leadership.

This player-coach role requires hands-on execution in year one and the build-out of a security program aligned with cross-functional teams.