Security Program Manager
Own end-to-end compliance programs (SOC 2, HIPAA, HITRUST), build customer trust function, implement automation, and partner with engineering on controls for a healthcare AI platform handling protected health information.
About the job
Responsibilities
- Own compliance programs end to end (SOC 2 Type II, HIPAA, and HITRUST) from readiness through audit and continuous monitoring.
- Build and run the customer trust function (security questionnaires, RFPs, due diligence, and our trust center).
- Stand up and administer compliance automation, turning evidence collection and control monitoring into a continuous, low-toil system.
- Author security policies, run security-awareness training, and drive access reviews and audit readiness across the company.
- Partner with engineering and legal to translate framework and customer requirements into concrete controls, and coordinate external auditors and penetration-testing firms.
- Own the risk register and give leadership clear, honest visibility into our security and compliance posture.
Requirements
- Typically 4–7 years in GRC, security compliance, or security program management, with a track record of running audits end to end.
- Hands-on experience with SOC 2 and HIPAA.
- Experience in a regulated, high-growth environment — ideally healthcare or another domain with serious data-handling obligations.
- Fluency with compliance automation tooling and enough technical literacy to work credibly with engineers on cloud, identity, and logging controls.
- Experience owning customer-facing security with enterprise buyers: questionnaires, trust centers, and due diligence.
- Strong written and verbal communication.
- Track record of moving quickly, finding shortcuts, and going to unreasonable lengths to deliver on goals.
- High NPS with your former teammates.
Nice-to-Haves
- HITRUST experience.
- Track record of standing up a new framework from scratch.
Skills
SOC 2, HIPAA, Hitrust, GRC, Compliance Automation, Risk Register, Security Policies, Audit Readiness, Penetration Testing, Cloud Controls, Identity Controls, Logging Controls
Similar jobs
Security Engineering jobs
Fluidstack
New York, NYThe Security Engineer will track advanced adversaries targeting frontier AI infrastructure, build intelligence pipelines, conduct threat hunts, and create production detections. The role requires hands-on malware and infrastructure analysis, production programming, and close collaboration with detection and incident response teams.
Figma
San Francisco, CASecurity Scientist analyzing attacker and user behavior, building data-driven detections, and leading security investigations and design reviews. Requires strong security and anti-abuse knowledge, SQL fluency, scripting proficiency, and experience with distributed data systems and statistical methods.
hud
San Francisco, CA
Own and build the company’s security program as its first full-time security hire, covering product, cloud, infrastructure, incident response, compliance, and customer trust. The role requires hands-on security engineering and incident leadership, with experience operating SOC 2 or comparable frameworks.
Stripe
United States
Conduct proactive threat hunting and adversary simulation to uncover financial fraud tactics, enrich threat intelligence, and improve platform controls. The role requires at least five years of relevant cybersecurity, abuse, or trust experience plus strong Python, SQL, investigative, and data-analysis skills.
Anthropic
San Francisco, CAConduct offensive security operations, red-team engagements, penetration testing, and adversarial simulations across cloud, endpoint, and bare-metal environments. The role requires at least five years of experience, strong engineering skills, and expertise across multiple security domains.