Manager of Security and Compliance

The role

You will lead the security program and compliance work by configuring and operating security tooling. You will own security incident response and lead HIPAA, SOC 2, and HITRUST programs.

What you will do

• Implement, configure, and operate core security controls including endpoint detection, identity, logging, and encryption.
• Mature detection and monitoring capabilities including centralized logging and SIEM.
• Triage vulnerability, cloud-posture, and penetration-test findings and drive remediation.
• Secure Azure and Kubernetes environments and automate security checks through scripting.
• Own and improve security and compliance programs across HIPAA, SOC 2, and HITRUST.
• Lead HITRUST certification, audits, and risk assessments end to end.
• Manage external security and compliance partners including advisory firms and assessors.
• Partner with Engineering, Product, and IT to integrate security into architecture and the SDLC.
• Lead security incident responses including investigation, containment, and post-incident reviews.
• Maintain security policies, procedures, BAAs, and data handling requirements.

Required qualifications

• 7+ years of experience in information security
• 3+ years in hands-on security engineering, operations, or administration
• Hands-on experience administering security tooling such as endpoint detection and response, SIEM, identity provider controls, and vulnerability scanning
• Hands-on experience securing at least one major cloud platform
• Ability to script or automate security tasks using PowerShell, Python, or KQL
• Working knowledge of HIPAA, SOC 2, HITRUST, healthcare privacy requirements, and security control frameworks
• Experience owning or leading a major workstream of an external certification or attestation (SOC 2 Type II, HITRUST, or ISO 27001)
• Hands-on incident response experience
• Experience partnering with Engineering and Product teams to incorporate security into technology and development processes
• Experience with vendor risk management and third-party security assessments
• Strong communication skills to translate security and regulatory requirements for technical and non-technical audiences
• Experience working with healthcare technology, EMRs, clinical systems, or healthcare data environments

Nice to have

• HITRUST certification experience (e1, i1, or r2)
• Experience implementing or tuning a SIEM (e.g., Microsoft Sentinel or a comparable platform)
• Experience with PACE, value-based care, Medicare/Medicaid, or regulated healthcare environments
• Experience as the first or sole security hire, or building or scaling security and compliance programs in a growing SaaS company
• Experience securing cloud-native environments (Azure and Kubernetes/AKS preferred), including DevSecOps and security automation
• Experience leading a small security/compliance team or cross-functional security initiatives
• Relevant certifications such as AZ-500, SC-200, GIAC, CCSFP, CISSP, CISM, or HCISPP

About the company

IntusCare is an end-to-end technology ecosystem built specifically for PACE and similar coordinated care models. They provide a purpose-built EMR and cloud-native solutions for complex senior care.