Requirements

• 7+ years in security, compliance, or risk management (3+ in leadership), with a Bachelor's degree or equivalent experience.
• Deep expertise in SOC 2 within AWS environments; familiarity with HIPAA frameworks is a significant plus.
• Familiarity with PHI handling, GRC and compliance automation platforms, and enterprise architecture frameworks such as TOGAF.
• Strong ability to manage multiple concurrent audit and certification workstreams.
• Excellent written and verbal communication skills to translate complex compliance requirements into clear actions.

Nice to haves

• CISA, CISM, or CISSP certifications.
• Experience with NIST 800-53, Cloud Security Alliance (CSA), and Center for Internet Security (CIS) frameworks.
• Experience in healthcare or other regulated industries; HITRUST experience is a plus.
• Experience building compliance roadmaps in early-stage startups.
• Exposure to containerization (Docker/Kubernetes), serverless, and big data platforms.
• Exposure to DevSecOps and sprint-based Agile development.
• Vendor management experience.

What you'll be doing

• Lead annual SOC 2 and HIPAA certifications, managing relationships with external auditors and professional services.
• Partner with Engineering to design and enforce technical security controls across AWS workloads including EKS, EC2, data pipelines, ensuring HIPAA and SOC 2 compliance.
• Define and maintain security policies and standards; embed risk assessment within engineering processes; evolve security risk management frameworks.
• Support vendor risk management, including contract reviews and security posture assessments.
• Automate evidence gathering and ensure controls are effective and minimally disruptive.
• Serve as the primary security contact for US regulators and partners; support alignment with ISO 27001/27701; report security risk status to leadership.
• Manage and integrate GRC and compliance automation platforms to streamline security monitoring and reporting.

Perks and benefits

• Competitive salary with annual reviews and performance incentive schemes.
• Paid holiday, sick leave, and female health leave.
• Enhanced parental leave and pay for maternity, paternity, same-sex, and adoptive parents.
• Accelerated professional growth through meaningful work and learning support.
• Hybrid work model with three days per week in-office collaboration.
• 5-week fully paid sabbatical on 5-year anniversary.
• Flo Premium access for friends and family, plus additional health, pension, and wellbeing benefits.