Senior Director, Security & Compliance

Role overview A senior leadership role accountable for the compliance and information security programs of a healthcare SaaS company serving rehab therapy providers and the patients they treat. The position acts as both the Compliance Officer and the designated HIPAA Security Officer, owning governance, controls, certifications, and the cross-functional operating model. It is a hands-on leadership role for someone who wants to build and mature programs while leveraging technical resources across the organization.

Responsibilities - Lead the enterprise compliance and information security programs as Compliance Officer and HIPAA Security Officer - Own HIPAA/HITECH compliance, including Security Risk Analysis, risk-management plans, and ongoing oversight of safeguards - Drive SOC 2 Type II and other certification, attestation, and assurance programs through audit readiness and remediation - Maintain the policy framework for compliance and information security, including governance of exceptions - Establish durable control ownership across functions and track deficiencies, risks, and remediation plans - Partner with engineering, DevOps, architecture, and IT to evaluate security approaches and risk posture - Own the incident-response framework and lead third-party risk management, customer diligence, audits, and RFP security responses - Provide governance for emerging technologies and the use of sensitive data, partnering with product, AI, engineering, and legal

Requirements - 8+ years in compliance, information security, risk management, or related disciplines, including meaningful leadership responsibility - Deep practical knowledge of HIPAA/HITECH, ideally within a covered entity or business associate environment - Demonstrated experience leading SOC 2 Type II or comparable assurance programs - Strong working knowledge of cloud security, application security, IAM, vulnerability management, endpoint security, and secure SDLC - Ability to engage credibly with technical leaders and translate technical issues into business, compliance, and customer impact - Relevant certifications such as CISSP, CISM, CRISC, CISA, or CHC preferred

Benefits and work setup - Remote or hybrid working environment - Competitive salary with potential equity compensation for strong performance - Flexible paid time off - Medical, dental, and vision insurance; company-paid disability and life insurance; company-paid family and medical leave - 401k, FSA/DCA, and commuter benefits; discounted pet insurance - Company-wide sponsored lunches and credits toward online fitness or gym memberships - Recovery suite at headquarters with cold plunge, sauna, and shower