[Hiring] Security & Compliance Manager @FamilyWell

Role Description

FamilyWell is scaling a HIPAA-regulated, AI-enabled care platform, and our security program has outgrown what our CPO and contractor CISO can manage day-to-day. We're hiring a Security & Compliance Manager to own the operational backbone of our security and compliance program.

• Own day-to-day management of the security program: Security Risk Assessment (SRA) cadence, penetration test coordination and remediation tracking, phishing simulations, and the annual security awareness training calendar.
• Draft Policies & Procedures (P&Ps) for CISO and leadership review/approval, and keep documentation current as the org and regulatory landscape evolve (e.g., the 2025 HIPAA Security Rule overhaul).
• Lead vendor security assessments and Business Associate Agreement (BAA) audits across FamilyWell's vendor ecosystem.
• Own MDM/BYOD device compliance monitoring, partnering with the IT Systems Administrator and our MSP on enrollment and endpoint security status.
• Serve as day-to-day lead on incident/breach response, escalating to the CPO and contractor CISO per FamilyWell's response plan.
• Support rollout of identity and access management improvements, including SSO and a company-wide password manager.
• Partner with the CPO and contractor CISO to prepare recurring board-level risk and compliance status reporting, including a forward-looking roadmap.
• Own compliance-automation tooling evaluation and rollout (e.g., Drata or Vanta) as FamilyWell works toward a SOC2 or HITRUST-ready posture.
• Track open items from SRAs, audits, and vendor reviews to closure (e.g., encryption gaps, audit-log access, policy sign-off) using FamilyWell's Security Program Tracker.
• Help define and maintain AI security guardrails (e.g., PHI handling policy for Claude/Cowork and other AI tools) as the platform and AI usage scale.
• Maintain detailed documentation and records of all security program controls, risks, incidents, vendor audits, and roadmap initiatives.

Qualifications

• 3–6+ years of experience in security compliance, IT security, or GRC (governance, risk, and compliance) roles.
• Direct experience with HIPAA Security Rule requirements, Security Risk Assessments, and vendor/BAA risk reviews — ideally in healthcare or another regulated industry.
• Comfortable running a security calendar and tracking remediation items to closure across multiple stakeholders.
• Experience partnering with a fractional or contractor CISO, MSP, or outside security advisor, and translating technical risk into clear, non-technical reporting for leadership or a board.
• Strong documentation and project management habits.
• Ability to work independently in a fast-paced, remote startup environment.

Nice-to-Haves

• Direct experience preparing for or achieving SOC2 or HITRUST certification.
• Familiarity with compliance automation platforms (Drata, Vanta, or similar).
• Experience with MDM/endpoint tools, Google Workspace security controls (DLP, Vault), and password manager rollouts.
• Experience in an early-stage or high-growth startup, comfortable building process from scratch.
• Familiarity with AI governance/security considerations for tools used with PHI.

Compensation Range

$132,000-$140,000