Lead Security & Compliance Analyst

About the Role

This is a hybrid role: roughly half security compliance and audit, half hands-on technical security. You'll own our compliance audit cycle end-to-end (SOC 1, SOC 2, HITRUST CSF, HITRUST AI), and you'll also work directly on the technical side: vulnerability management, security findings remediation, cloud security reviews, and third-party risk.

Responsibilities

Compliance & Audit

• Own SOC 1, SOC 2, HITRUST CSF, and HITRUST AI audits end-to-end: scoping, evidence collection, auditor coordination, and findings remediation
• Develop, update, revise, and implement compliance policies, procedures, and practices for security frameworks (HIPAA, HITRUST, SOC) as well as general compliance and operations
• Manage our compliance automation and trust platforms (Drata, SafeBase), including control monitoring and responses to customer security questionnaires.
• Coordinate with external vendors and clients to gather information needed for compliance reviews, validations, and audits
• Run third-party/vendor risk assessments and respond to customer security assessments and external inquiries
• Deliver HIPAA and security awareness training and measure control effectiveness through internal audits

Technical Security

• Run the vulnerability management program: scanning, triage, prioritization, and driving remediation with engineering teams
• Investigate and remediate security findings across our AWS environment (EKS, WAF, Shield, CloudFront, IAM) and SaaS stack
• Review external attack surface findings (e.g., SecurityScorecard) and implement fixes from CSP headers to subresource integrity to TLS configuration
• Support security incident response: log analysis, forensic evidence collection, and containment
• Support fraud and forensic investigations authentication log analysis, targeted data extraction, and evidence preservation in support of legal and compliance matters
• Improve our security tooling and automate evidence collection, using scripting (Python, Bash) where manual work can be eliminated

What We're Looking For

• 4+ years combined experience across security compliance/GRC and hands-on technical security
•  Direct experience supporting SOC 1/SOC 2 and/or HITRUST audits — you've been through at least one full audit cycle
• Working knowledge of HIPAA Security and Privacy requirements
• Hands-on experience with vulnerability scanning and remediation, and comfort reading technical findings (CVEs, misconfigurations, cloud security issues)
• Familiarity with AWS security concepts (IAM, security groups, logging, WAF)
• Ability to write clear policies and procedures and equally clear remediation tickets

Nice to Have

• Experience with compliance automation platforms (Drata, Vanta, or similar)
• Experience in healthcare or another regulated industry
• Certifications such as CISSP, CISA, CRISC, HITRUST CCSFP, or CISM
• Experience with SIEM tools and log analysis
• Experience with forensic log analysis, fraud investigations, or supporting legal/eDiscovery requests

Benefits

• Medical, Dental, and Vision Coverage: Comprehensive plans with options for low-to-no-cost premiums.
• Employer HSA Contribution: Company-funded contributions to your Health Savings Account.
• 401(k) Retirement Plan
• Equity Incentive Plan
• Annual Company-Wide Bonus: Opportunity for up to 15% bonus based on company performance.
• Remote-First Culture: We are remote-first with a dedicated NYC office and reimbursement options for co-working spaces.
• Flexible Vacation Policy
• Summer Fridays: 5 additional Fridays off during the summer (separate from PTO).
• Home Office and Wellness Stipend
• Monthly Internet Stipend
• Annual Learning and Development Stipend

Base Salary Band (based on experience and level)

$80,000 - $135,000