Senior Manager, Security & Compliance
Leap · Remote · US (Remote) · New York City ·
COMPENSATION
$150k – $190k
Listed on the employer's job board (Ashby)
- Senior individual contributor
- Healthcare security focus
- HITRUST certification goal
- GCP cloud environment
- Fully remote potential
You will shape the next phase of Leap's security strategy, moving beyond established SOC 2 and HIPAA foundations to achieve HITRUST certification. As a hands-on builder, you will execute audits, write policies, and manage external partners while collaborating with Engineering and Operations teams.
What you'll do
- Lead HITRUST certification from gap assessment through final completion
- Manage end-to-end SOC 2 Type II audits and auditor relationships
- Maintain HIPAA security controls, privacy policies, and BAA obligations
- Review security posture and create prioritized improvement roadmaps
- Implement new controls and policies across GCP and data stacks
- Assess third-party vendors and tools, including AI solutions
- Complete security questionnaires and define client security obligations
- Manage external security partners and report risk status to leadership
What you'll need
- Seven or more years in healthcare security, GRC, or IT audit
- Direct ownership of at least one full SOC 2 Type II audit cycle
- Deep knowledge of SOC 2, HIPAA, and HITRUST frameworks
- Experience building security programs at startups or growth-stage firms
- Proven ability to handle enterprise security questionnaires and reviews
- Working knowledge of HIPAA Rules and handling patient health data
- Technical depth in cloud infrastructure, preferably GCP
- Ability to make high-stakes judgment calls on security commitments
Nice to have
- Hands-on experience leading a company through HITRUST certification
- Background in health tech, digital health, or benefits sectors
- Familiarity with ISO 27001 standards
- Experience with compliance automation tools like Vanta or Drata
- Holding CISSP, CISA, CISM, or CRISC certifications
Stack
- GCP
- SOC 2
- HIPAA
- HITRUST
- Vanta
- Drata
- Secureframe