Director, Compliance & AI Governance

Responsibilities

• Own AKASA’s compliance certification portfolio end to end, including HITRUST CSF, SOC 2 Type II, and HIPAA, from control design and implementation through evidence collection, audit coordination, and remediation.
• Evaluate and pursue certifications and attestations such as ISO 27001, ISO 42001, and HITRUST AI.
• Define compliance roadmaps and drive organization-wide adoption of regulatory requirements.
• Build an AI governance program grounded in the NIST AI Risk Management Framework (AI RMF), including model risk assessments, AI use policies, and documentation.
• Implement and optimize GRC and continuous control-monitoring tools, automate evidence collection, and use AI tools to streamline policy drafting, control mapping, and audit preparation.
• Own the policy lifecycle, including authoring, review cadences, exception handling, attestation campaigns, version control, and framework mapping.
• Lead security and compliance questionnaire responses, support enterprise sales cycles, manage customer audits, and maintain BAAs, the trust center, and shared assessments.
• Oversee vendor and third-party risk management, annual risk assessments, security awareness and HIPAA training, incident-response documentation, and tabletop exercises.
• Partner with Legal and Security leadership on security-related contractual obligations.

Requirements

• 8+ years of experience in security compliance, GRC, or risk management, including 2+ years leading a team or function.
• Healthcare SaaS, health tech, or AI startup experience strongly preferred.
• Hands-on expertise with HITRUST CSF, SOC 2 Type II, HIPAA Security and Privacy Rules, and AI governance frameworks such as NIST AI RMF.
• Experience managing certification and audit cycles from start to finish and translating AI governance standards into controls for systems handling PHI.
• Experience with GRC and continuous control-monitoring platforms such as Vanta, Drata, or Hyperproof; evidence-collection automation; and AI tools such as ChatGPT or Claude.
• Experience drafting policies, mapping them across frameworks, and managing review, exception, and attestation cycles.
• Comfortable handling enterprise security questionnaires, sales-cycle support, BAA and security-term negotiations with Legal, and customer audits.

Nice-to-Haves

• Experience achieving or maintaining ISO 27001, ISO 42001, or HITRUST AI certifications.
• Familiarity with Okta, Kandji/Iru, SentinelOne, Nightfall, and AWS.
• Experience with CCPA/CPRA, state health data laws, or GDPR.
• Experience implementing compliance automation tools and trust centers such as Drata or Vanta.
• Scripting or low-code automation skills using Python, Zapier, or Tray.io.
• Certifications such as CISSP, CISA, CIPP/US, HCISPP, or HITRUST CCSFP.

Benefits

• Flexible paid time off.
• Health, dental, and vision coverage.
• Employer contribution to Health Savings Accounts.
• Generous parental leave.
• Company-paid life insurance.
• Home office stipend.
• Cell phone and internet reimbursement.
• Commuting benefits.
• Company-paid holidays.
• 401(k) plan.
• Equity.

Compensation

• $150,000–$185,000 annual salary plus equity.