Security & Compliance Associate

About the role

As a Security and Compliance Associate, you’ll work closely with Healthie’s VP of Security and Compliance to help operate and strengthen the security and compliance programs that support our business, customers, and platform. This is a hands-on role for someone who is highly organized, detail-oriented, and comfortable owning work from intake through completion.

You’ll support third-party audits, assess vendor risk, respond to customer and internal security and compliance requests, and help keep the day-to-day work of the function moving. You’ll collaborate across technical and business teams and will be trusted to work with sensitive information, follow through on open items, and know when something needs to be escalated.

The work will include:

• Helping with third party audits such as SOC 2, annual HIPAA assessment, and HITRUST, including gathering evidence and following-up on the artifacts that are missing
• Assessing third party’s security risk, interacting with vendors and driving remediation items to closure
• Answering internal and customer questions regarding security and compliance
• Answering security and compliance questionnaires from customers and prospective customers
• Prioritizing incoming requests across multiple channels to security and compliance, and answering, escalating, or delegating them. Some of this is routing, and some is assigning compliance work to people senior to you and following up until it is done
• Collaborating with other departments, primarily IT, Operations, Platform, R&D, and the offices of the CEO and CTO

What a week may look like: A few customer questionnaires, a vendor review or two, and evidence pulled for whatever audit is in flight. The queue gets cleared daily, including whatever Vanta flags and the questions from other teams who are blocked until they get an answer. Audit season is the exception. When evidence requests land, that is the week.

Note that you will have access to some of the company's most sensitive information, including data entrusted to our protection by customers and their clients. You must follow access rules exactly, raise your own mistakes before anyone else finds them, and keep confidence when it would be easier not to. Colleagues should be able to watch how you work and copy it.

This position might be suitable for someone with work experience in compliance and/or IT SOX work. But you might also be a fresh JD, BA, or MA that has an affinity for this kind of work in a dynamic, challenging, and exciting environment.

About you

• You must be based in the United States. (The reason for this is that on occasion you may need to see protected health information [PHI], and our customers have contracts that forbid access to such information from outside the United States.)
• You must be an excellent and fluent writer, speaker, and communicator in English. Those skills must be at least as good as any AI (in other words, you should be able to write, speak, and communicate without the aid of AI). You can compress a dense control requirement into two sentences a customer's security team will accept, and document an exception so it still holds up when someone audits it next year.
• You must understand or have an aptitude for the scope of the security and compliance challenges faced by a modern healthcare software company.
• You must be adept with AI. You are not an expert, but you are able to write useful prompts that get answers to the questions you want. You are also skilled at identifying AI slop and wading through and correcting AI bloviation. You can spot when a model is confidently wrong, and you know when to rewrite it rather than pass it along.
• You are interested in software, technology, and its impact on humans. You are curious and will ask why a control exists before you enforce it, creative at finding a workable answer when the framework doesn’t give you one, and empathetic enough to understand why the person on the other end of the request is frustrated. Healthie's scope is quite large, and you will be asked to provide perspective with regard to how the technology fits with human expectations, both of Healthie's customers, and the clients of Healthie's customers.
• You can hold a position with people more senior than you when the requirement is clear, and change it when someone gives you a better reason. You will be new to a lot of this and expected to ask early rather than guess.

Nice to Have

• You are familiar with modern GRC tooling such as Vanta, Drata, SecureFrame, or Thoropass.
• You are familiar with some of the regulatory frameworks in healthcare security and compliance: HIPAA, state level regulations, GDPR, the EU AI Act.
• Any of CISA, CISM, CISSP, CIPP/US, CIPP/E. Note that this is not a requirement and a narrow professional background in these areas is not what we are looking for.

Details, details

• This is a full-time, NYC-Hybrid position.
• U.S. work authorization is required.
• The salary for this position is a base between $100,000 - $130,000.

Interview Process

• Quick chat with Katie from our Talent team (15 minutes)
• Interview with John, VP Security & Compliance (30 minutes)
• Talk with Edgar, Director of IT & Cindy, Director of People Operations: (30 minutes)
• Interview with Sean, Staff AppSec Engineer(20 minutes)
• Exec Interview with Cavan, CTO + cofounder (20 minutes)
• Reference checks

Learn more at gethealthie.com/careers.