Security Lead

We're hiring a Security Lead to own governance, risk, and compliance (GRC) while building and strengthening security architecture in a cloud-native environment. This is a hands-on individual contributor role with no direct reports, but senior ownership of security programs and architecture.

Responsibilities:

• Own and operate HITRUST/SOC2 programs; ongoing management, not just audit participation.
• Translate risks into structured cost vs. risk quantification for nontechnical leadership.
• Build and improve cloud-native security infrastructure (AWS, GCP, Azure).
• Evaluate and manage external security vendors/consultants (scoping, risk assessment, accountability).
• Drive AI/LLM security initiatives, assess risks in AI products, govern internal LLM usage, and build controls for agentic AI systems.
• Embed security into SDLC: IAM, secrets management, network segmentation, architecture reviews.
• Represent security credibly in customer-facing forums (questionnaires, trust reviews).
• Operate as a solo IC; recent hands-on security work, not pure people management.

Requirements:

• 7+ years in security, with 3+ years in a regulated environment (HIPAA, finance, or government).
• Proficiency in Operational HITRUST or SOC2 experience (managed/maintained ongoing program).
• Knowledge of Structured risk quantification with documented cost vs. risk recommendations.
• Proven experience building/improving cloud-native security infrastructure.
• Track record evaluating/managing external security vendors.
• Direct hands-on AI/LLM security work.
• Evidenced cost vs. risk judgment (documented tradeoffs, not defaults).
• Comfort operating as a solo IC with recent hands-on security work.

Should Have:

• SOC2 Type II operational experience.
• CISSP / CISM / CCSP or equivalent certification.
• Familiarity with EHR integration security (HL7 FHIR, Epic/Athena).
• Agentic AI systems experience (tool calling, multistep workflows).
• High-growth startup exposure (Series A-C).
• Direct enterprise customer-facing security work.

Could Have:

• Healthcare domain depth (RCM, clinical workflows).
• Security awareness/training program design.
• GCP specialisation (AWS/Azure equally acceptable).
• Multitenant / multi-BAA architecture experience.
• Publications, conference talks, or research contributions.