Senior Security Engineer - Compliance and Risk

Khealthcareers; New York (NY); Hybrid; USD 150,000 - 200,000; Full time

Benefits offered by this job

Hybrid work schedule

Monthly social committees

18 vacation days

9 company holidays

Stock options

Job summary

Khealthcareers is seeking a detail-oriented Security Compliance Engineer to join its Security team in New York City. This role involves managing compliance aspects of critical security programs such as vulnerability management and privacy regulations, ensuring adherence to SOC 2, HIPAA, and HITRUST standards.

The position offers a hybrid work schedule with numerous benefits including competitive health insurance and stock options. Ideal candidates will have 3-5+ years of relevant experience and strong organizational skills.

Qualifications

• 3-5+ years of experience in Information Security, Governance, Risk, Vulnerability Management, Compliance (GRC), or IT Audit.
• Proven experience managing specific compliance verticals like vulnerability management or business continuity.
• Exceptional documentation skills.

Responsibilities

• Oversee the compliance aspect of the vulnerability management program.
• Manage adherence to internal privacy policies and external regulations like HIPAA.
• Coordinate annual or bi-annual DR/BCP exercises and technical tests.
• Serve as a primary point of contact for external auditors during assessments.

Skills

Information Security

Governance

Risk Management

Vulnerability Management

Compliance (GRC)

Job description

About the role

We are seeking a detail-oriented, proactive Security Compliance Engineer to join our Security team.

In this role, you will not just check boxes; you will own the governance and compliance lifecycle for critical security programs and, in many cases, be actively involved in implementation and remediation. You will ensure that our vulnerability management, privacy, data retention, and business continuity efforts meet the rigorous standards of SOC 2, HIPAA, and HITRUST, protecting our sensitive healthcare data and maintaining trust with our partners.

This role requires onsite presence in our New York City office 4 days a week and does not provide immigration support.

What you will do

Vulnerability Management Governance

• Oversee the compliance aspect of the vulnerability management program, ensuring scans and remediation efforts adhere to SLAs.
• Track and report on remediation timelines to ensure evidence is audit-ready.
• Collaborate with engineering and IT teams to validate that exceptions are documented, risk-accepted, and reviewed periodically.
• Manage and handle “tracking technologies” to comply with partner requirements.

Privacy & Data Governance

• Manage adherence to internal privacy policies and external regulations (HIPAA, State Laws, CCPA).
• Manage adherence to partner-specific health system requirements.
• Monitor data retention schedules to ensure data is stored, archived, and purged in accordance with policy and legal requirements.
• Conduct periodic privacy impact assessments (PIAs) for new products or features.

Disaster Recovery (DR) & Business Continuity (BCP)

• Coordinate annual or bi-annual DR/BCP table-top exercises and technical tests.
• Maintain and update DR/BCP documentation, ensuring contact lists and recovery procedures are current.
• Review post-mortem reports from tests to ensure continuous improvement and compliance with availability trust principles.

Audit & Framework Management (SOC 2 & HITRUST)

• Serve as a primary point of contact for external auditors during SOC 2 and HITRUST assessments.
• Collect, organize, and review evidence on the controls for the programs above.
• Identify compliance gaps and drive remediation projects before external audits begin.

What we're looking for

• Experience: 3-5+ years of experience in Information Security, Governance, Risk, Vulnerability Management, Compliance (GRC), or IT Audit.
• Program Management: Proven experience managing specific compliance verticals like vulnerability management or business continuity.
• Communication: Ability to translate compliance requirements into actionable technical tasks for engineering teams.
• Organization: Exceptional documentation skills—you understand that "if it isn't written down, it didn't happen."
• Influence: Ability to drive consensus and compliance across teams without direct management authority.

Benefits & Perks

• Hybrid work schedule with weekly lunches and stocked fridges
• Monthly social committees for company events
• 18 vacation days, 9 company holidays, 5 sick days, and 2 personal days
• Stock options for every full-time employee
• Paid parental leave
• 401k benefit
• Commuter Benefits
• Competitive health, dental, and vision insurance options

Compensation: $150,000 – $200,000 USD

We are proud to be an Equal Opportunity Employer and consider applicants for employment regardless of race, ethnicity, religion, color, national origin, ancestry, disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, sexual orientation, pregnancy, childbirth and breastfeeding, age, citizenship, military or veteran status, or any other class protected by applicable federal, state, and local laws. We’re deeply committed to building teams as diverse as the patients we serve and strive to cultivate an environment where everyone can bring their most authentic self to work. We depend on our differences to make our team stronger, our workplace more dynamic, and our product accessible to all of our users.

We are committed to maintaining the integrity of our hiring process and ensuring a safe environment for all candidates. All communication for job offers from K Health will come from email addresses ending in @khealth.com. K Health will never ask you to provide financial information about yourself during the recruitment process. We will never use personal email accounts or other domains for official correspondence. Our official job postings are only listed on our official website and reputable job boards. Be cautious of job offers from sources other than these platforms.