Want to know if this job is worth applying to?
Remote, Oregon, United States
Remote only
Leap is one of the fastest-growing benefits solutions and a category-defining pioneer in employer specialty pharmacy. We are reshaping how life-changing therapies are delivered and financed, ensuring patients get the treatment they need while employers finally get a fair deal.
Specialty drugs and infusions represent nearly 10% of all healthcare spend and are the fastest-growing cost category for employers. Leap tackles this challenge with a novel approach: eliminating hidden markups, expanding access to high-quality infusion providers, and bringing clarity and fairness to how therapies are priced and paid for.
We’re proud to partner with numerous Fortune 500 companies and leading TPAs. Each patient we serve creates immediate ROI: lower costs, improved access, and better care. Join us as we redefine what’s possible in specialty care.
Leap is hiring a Senior Manager, Security & Compliance to lead the next phase of our security program. We have an established foundation, including SOC 2 Type II and HIPAA-aligned controls. Now we’re looking for a leader to shape where the program goes next and own the work of getting there, starting with HITRUST certification.
This is a hands-on builder role. You’ll set the direction for our security and compliance program and do much of the work yourself: running audits and certifications, writing policies, reviewing controls, and completing security questionnaires. You’ll also be trusted with the judgment calls that matter most, including the security obligations Leap commits to, the vendors and tools we adopt, and how new controls roll out across the company.
You’ll represent Leap with client and partner security teams when it counts, but the core of the job is building and maintaining a program strong enough to make those conversations easy. You’ll work closely with Engineering, Operations, and our go-to-market teams, and you’ll manage our external security partner.
This is an individual contributor role for an ambitious, highly autonomous security leader who thrives on building end-to-end and driving strategic impact.
Run HITRUST certification from kickoff through completion next year, including gap assessment, control mapping, remediation, and assessor management.
Own SOC 2 Type II end to end, including evidence collection, the auditor relationship, and closing gaps.
Maintain our HIPAA security and privacy controls, core policies, and BAA obligations.
Complete a full review of Leap’s security posture and deliver a prioritized roadmap of improvements and tooling recommendations.
Roll out new controls, policies, and processes across the company, partnering with Engineering on implementation across our GCP and data stack.
Assess new vendors and tools, including AI tools, and run ongoing third-party risk reviews.
Complete security questionnaires, RFP security sections, and controls reviews yourself, with responses that are accurate and consistent.
Make the call on the security obligations Leap takes on in client and partner agreements.
Build a response library and repeatable review process that keeps pace as we grow, and represent Leap with client and partner security teams when needed.
Select and manage our external security partner, making sure they extend the program we own internally.
Keep leadership informed on security posture, risk, and compliance status, and flag where investment is needed.
7+ years in healthcare information security, governance/risk/compliance (GRC), or IT audit, including directly owning at least one full SOC 2 Type II audit cycle.
Deep familiarity with security and compliance frameworks such as SOC 2, HIPAA, and HITRUST, and an audit- and GRC-first approach to building a program.
Experience building a security or compliance program from scratch, or owning one end to end as an early security hire at a startup or growth-stage company.
Hands-on experience completing security questionnaires and representing your company with enterprise or health plan security teams.
Working knowledge of the HIPAA Security and Privacy Rules and of handling patient health data (PHI) in B2B healthcare.
Enough technical depth in cloud infrastructure (GCP preferred) and modern data stacks to review controls and advise engineers through implementation. This isn’t a policy-only role.
Comfort staying deep in the details while making judgment calls that commit the company.
Hands-on experience taking a company through HITRUST certification.
Health tech, digital health, or benefits experience, especially with health plans and large self-funded employers.
ISO 27001 experience.
Experience with compliance automation tools such as Vanta, Drata, or Secureframe.
CISSP, CISA, CISM, or CRISC certification.
At Leap, we’re building an outlier company with real impact — and that takes focus, energy, and commitment. If that excites you, we’d love to hear from you.
Leap is an equal opportunity employer and welcomes applicants from all backgrounds. We’re committed to building a team that reflects a diversity of perspectives, experiences, and identities.
.png?1733430365){kind=logo}
