Head of Security & IT

The Role

SuperDial is hiring its first Head of Security & IT: a hands-on leader who will own the company's security, compliance, and corporate IT functions end to end.

This is a builder role. You will set the security strategy, run our compliance programs, and keep our people, devices, and vendors secure, while partnering closely with Engineering on the security of the product itself. You will be the person customers, auditors, and leadership turn to when they need confidence that SuperDial is secure.

Success means audit-ready compliance programs, a corporate IT environment that is secure by default, and a security posture that scales with the company rather than slowing it down.

This role is based in our San Francisco office and reports to [reporting line - confirm].

Compliance programs

• Own SuperDial's compliance programs end to end, including SOC 2 and HIPAA (and future frameworks as customer needs evolve)
• Drive audit readiness and lead evidence collection across the company
• Write, maintain, and enforce security and compliance policies
• Manage relationships with auditors and compliance vendors
• Identify and close compliance gaps before they become customer or audit issues

Corporate IT

• Manage devices, identity and access management (IAM), and SSO across the company
• Enforce VPN usage and endpoint protection on all company devices
• Administer core software and SaaS tools, including provisioning and license management
• Oversee contractor-delivered IT support and hold vendors to clear service standards

Information security

• Design, implement, and monitor security controls across the company
• Run regular risk assessments and maintain the risk register
• Lead vulnerability management, from identification through remediation
• Own security monitoring arrangements, whether in-house or through managed providers
• Build and test incident-response plans so the company is ready before an incident occurs

Employee lifecycle and training

• Run security awareness training for all employees and contractors
• Own the security side of onboarding and offboarding, partnering with People Ops
• Ensure timely access provisioning and removal across all systems
• Maintain the documentation that supports these processes for audits

Application security

• Schedule and manage penetration tests, and define testing scope with Engineering
• Track findings and drive remediation to closure with engineering owners
• Partner with Engineering on secure development practices; you are accountable for the program, not for personally performing every technical review

Third-party security

• Run vendor security assessments before onboarding new tools and partners
• Manage vendor access controls and conduct ongoing reviews
• Track vendor-related risks and contractual security obligations
• Respond to customer security questionnaires and support security reviews in the sales process

What You Bring

• 7+ years in security, IT, or compliance, including at least 2 years leading a security or IT function
• Direct ownership of a SOC 2 audit (Type II preferred) from readiness through report
• Working knowledge of HIPAA security requirements and handling of protected health information (PHI)
• Hands-on experience administering IAM/SSO (e.g., Okta, Google Workspace), MDM, and endpoint protection tools
• Experience running vulnerability management, penetration testing programs, and incident-response planning
• Experience assessing and managing third-party vendor risk
• Comfort being both strategic and hands-on: writing the policy, configuring the tool, and presenting to leadership
• Clear, confident communication with engineers, executives, auditors, and customers alike

Nice to Have

• Experience as the first security or IT hire at a venture-backed startup
• Background in healthcare technology, revenue cycle management, or another regulated industry
• Familiarity with compliance automation platforms (e.g., Vanta, Drata)
• Exposure to cloud security (AWS or GCP) and AI/ML systems handling sensitive data
• Relevant certifications such as CISSP, CISM, CISA, or Security+