Security and Compliance Manager

The Opportunity

We are seeking a Security and Compliance Manager to own the day-to-day operation of our compliance program end to end, keeping our frameworks audit-ready, our policies current, and our workforce systems locked down.

This is a critical role for someone who can manage our compliance platform of record, drive remediation on failing controls to closure, and administer the workforce security layer (Google Workspace and MDM) that our compliance posture depends on. You will work closely with engineering, product, and executive leadership to keep the company continuously compliant as we scale at high velocity.

This is not a purely administrative, ticket-routing role. You should be comfortable owning remediation from detection to closure, operating with high rigor, and driving issues to resolution yourself rather than just flagging them, in a fast-moving startup environment.

We believe a successful compliance function is defined not by simply passing audits, but by continuous audit-readiness, strong workforce security hygiene, and trust earned with enterprise customers.

What You'll Own

• Own our compliance platform of record - manage frameworks (SOC2 Type II, HIPAA, NIST, etc.), controls, tests, policies, and integrations.
• Monitor compliance tests continuously; triage failures, remediate directly where possible, and drive owners to resolution where not.
• Maintain and update security policies, procedures, and system documentation, ensuring they reflect actual practice and are reviewed/acknowledged on schedule.
• Manage evidence collection and audit readiness, keeping automated evidence flowing and closing gaps in manual evidence before auditors ask.
• Coordinate external audits (SOC2 Type II, HIPAA, NIST, ISO, etc.) end to end - auditor communication, evidence requests, findings, and remediation plans.
• Administer Google Workspace, including user lifecycle management, access controls, 2FA/SSO enforcement, and audit log reviews.
• Manage our MDM to ensure all endpoints are enrolled, encrypted, patched, and compliant with policy.
• Track risk via risk assessments and the risk register, and lead mitigation planning with stakeholders.

What We're Looking For

• Compliance Ownership: You treat a failing compliance test as a to-do item, not a ticket to route elsewhere - you drive remediation from detection to closure yourself.
• Operational Rigor: You maintain accurate, up-to-date policies and documentation, and keep evidence collection running continuously rather than scrambling before an audit.
• Security & IT Administration Fluency: You're comfortable administering Google Workspace and MDM tooling directly - user lifecycle, access reviews, and endpoint compliance are second nature to you.
• Cross-Functional Collaboration: You partner effectively with engineering, product, and leadership, scoping remediation work and reporting compliance posture clearly to non-technical stakeholders.
• High Ownership Mindset: You operate with follow-through in a high-velocity, fast-scaling environment, without needing heavy oversight.

Required Qualifications

• 3+ years of experience in security compliance, GRC, IT security administration, or similar roles.
• Hands-on experience administering a compliance automation platform (e.g., Vanta, Drata, or Secureframe), including frameworks, tests, policies, and remediation workflows.
• Direct experience with SOC2 Type II and/or HIPAA compliance programs - evidence collection, audits, and continuous control operations.
• Experience administering Google Workspace in a business environment (user lifecycle, security settings, access controls).
• Experience managing an MDM solution (e.g., Kandji, Jamf, Mosyle, or similar) for endpoint compliance.
• Ability to write, maintain, and operationalize security policies and compliance documentation.
• Strong organizational and follow-through skills - comfortable owning remediation from detection to closure.

Preferred Qualifications

• Experience in healthcare, healthtech, or another regulated data environment.
• Familiarity with additional frameworks (HITRUST, ISO27001, NIST) and experience adding new frameworks to a compliance platform.
• Experience supporting enterprise customer security reviews, RFPs, and partner compliance requirements.
• Working knowledge of cloud environments (GCP preferred) sufficient to coordinate remediation with engineering teams.
• Experience with identity and access tooling (SSO/SAML, Google Cloud Identity, Okta, or similar).
• Certifications such as CISA, CISM, Security+, CCSK, or equivalent practical experience.

Base salary

$110,000-$165,000 + equity

Actual compensation will depend on experience, scope, and overall alignment with the role.

We offer competitive compensation, equity participation, healthcare coverage (medical, dental, vision), unlimited PTO, and a 401(k) with company match plus Roth option.