Compliance Lead

About the Job

As our Compliance Lead, you'll own and operationalize our compliance program - turning our regulatory obligations into a scalable, audit-ready system that earns the trust of health systems, investors, and the patients behind the data. Avandra handles protected health information across a growing network of health system partners.

This is a build role. You'll work alongside our IT & Security Manager, contributing to security posture while owning the compliance workstream end-to-end. If you're energized by standing up programs - not just maintaining them - this is your role.

What You'll Do

Compliance Program Management

• Own Avandra's compliance roadmap across HIPAA, HITRUST, and SOC 2; drive certification timelines and recertification cycles.
• Maintain the risk register and conduct company-wide risk assessments on a defined cadence.
• Author, publish, and maintain security and compliance policies and procedures.
• Evaluate emerging frameworks (ISO 27001, NIST CSF) for relevance as we scale.

Audit & Evidence Readiness

• Coordinate evidence collection, gap assessments, and control testing across Engineering, Operations, and People teams.
• Manage audit relationships with external assessors and compliance-automation platforms.
• Maintain audit-ready documentation at all times - not just at audit season.

Vendor Risk Management

• Own the vendor security intake and assessment process.
• Respond to customer security questionnaires, RFPs, and due diligence requests; represent Avandra'scompliance posture credibly to health system partners.

M&A Compliance Integration

• Conduct compliance assessments for acquisition targets - evaluate PHI handling practices, existing certifications, policy maturity, and open audit findings.
• Own the post-acquisition compliance integration playbook: gap analysis, remediation roadmap, and timeline to bring acquired entities under the Avandra compliance umbrella.
• Assess and rationalize subsidiary compliance programs; identify redundancies, coverage gaps, and certification consolidation opportunities.
• Serve as the compliance integration contributor in cross-functional M&A workstreams alongside Legal, Finance, and Engineering.
• Maintain a consolidated compliance posture across all entities - ensuring no subsidiary operates outside Avandra's policy and control framework.

Training & Culture

• Develop and deliver company-wide compliance training, including onboarding programs tailored to acquired teams.
• Translate complex regulatory requirements into clear, actionable guidance for non-compliance teams.

What You'll Need

Required

• 5+ years of hands-on compliance experience at a B2B SaaS or healthcare technology company.
• Demonstrated ownership of HIPAA compliance programs; working knowledge of HITRUST (i1 or r2).
• SOC 2 Type II experience - you've coordinated evidence, managed auditors, and closed gaps.
• Ability to work cross-functionally with Engineering on technical controls without needing a translator.
• Strong written communication - policy writing, questionnaire responses, and executive summaries are all in your wheelhouse.
• Self-starter mentality; you build structure in ambiguity.

Preferred

• Experience supporting compliance assessments or integration work in M&A contexts.
• Familiarity with multi-entity or subsidiary compliance program management.
• CISSP, CISM, HCISPP, or equivalent certification.
• Experience with compliance automation tooling (Vanta, Drata, Tugboat Logic, etc.).
• Familiarity with PHI data flows, health data integrations, and healthcare data contracts.
• Prior experience at a growth-stage startup where the compliance program was being created, not inherited.

What We Offer

• Meaningful Impact: The work we do directly enables medical breakthroughs - such as earlier cancer detection, better Alzheimer's treatments, AI diagnostics that save lives. This isn't abstract; it's the reason our health system partners invest in us.
• Career-Defining Opportunity: You'll have a front-row seat to every aspect of building a category-defining company-strategy, operations, fundraising, M&A, scaling.
• Exceptional Team: Work alongside a founder with a track record of building and exiting healthcare technology companies, backed by investors who are true partners.
• Competitive Package: Competitive salary, equity, comprehensive benefits, and hybrid work flexibility.
• Values-Driven Culture: We're building a team grounded in Avandra's 5 Core Values that guide how we show up every day:
• WIN with Integrity
• Radical Accountability
• Engage with Empathy
• Innovation Through Playful Curiosity
• Patients First

Salary Range

• $160,000 - $180,000 base salary, depending on experience and alignment with role expectations.