[Hiring] Senior Director of Compliance @SimplePractice

Role Description

We're hiring a Senior Director of Compliance to own our regulatory compliance program end to end — the person accountable for making sure we handle protected health information, and the businesses that depend on us, the way the law and our customers expect.

You'll report to the Chief Legal Counsel and work in close partnership with our CISO and Product/Engineering leadership. This is a strategy and program-ownership role: you'll set direction and represent our compliance posture to the executive team, while a team of managers and analysts runs the day-to-day operations you design.

Responsibilities

• Program strategy & governance
  • Define the compliance program, set the compliance program's roadmap, priorities, and risk appetite.
  • Own risk assessments and the compliance risk register.
  • Hold risk-acceptance authority up to a defined threshold, escalating above it to the CLO.
  • Chair a cross-functional Compliance/Privacy/Security steering group with Legal, Security, and Product.
• Regulatory implementation
  • Convert legal interpretation of HIPAA, state health-data privacy laws, 42 CFR Part 2, AI laws, and other applicable regimes into internal policy, control requirements, and product specifications.
  • Own the compliance policy library: approval authority, review cadence, and mapping policies to the controls they satisfy.
• Product & risk
  • Participate in product planning and governance for regulated feature areas.
  • Surface risk and work with Legal on regulatory readiness before launch of higher-risk features.
  • Own the vendor risk program: set the risk-tiering methodology and BAA standards.
  • Personally review and sign off on high-risk or critical vendors.
• Audits, incidents & investigations
  • Own certification and audit strategy: annual audits for existing certifications and what to pursue.
  • Coordinate the business side of regulatory examinations, audits, and subpoenas alongside Legal.
• Culture & reporting
  • Own the content and cadence of company-wide compliance training.
  • Set the standards and escalation tiers for internal compliance advisory.
  • Deliver a biannual compliance program report to the CLO, CEO, and board Audit/Risk Committee covering risk posture, open remediation, and the risk horizon.

Qualifications

• 15+ years of experience in healthcare regulatory compliance, risk, or GRC, including at least 7 years leading a compliance program or function.
• Experience on both sides of the table — inside a covered entity (health system, practice group, or payer) and inside a health-tech/SaaS vendor operating as a business associate.
• Deep working knowledge of HIPAA (Privacy, Security, Breach Notification, and Enforcement Rules), state comprehensive and health-specific consumer privacy laws, and 42 CFR Part 2.
• Have personally led an organization through a real regulatory event — an OCR investigation, a state AG inquiry, a reportable breach, or a certification remediation against a hard deadline.
• Experience shipping compliance requirements into a live product roadmap inside an agile/SaaS environment.
• Track record building and managing a compliance team and owning a budget.
• Certified in Healthcare Compliance (CHC), or willingness to obtain within the first year.
• Executive presence: able to present risk in business terms to a CEO or CLO.

Bonus Points

• CHPC or CIPP/US.
• Working familiarity with HITRUST, SOC 2, ISO 27001, or PCI DSS sufficient to direct audit strategy.
• Experience with behavioral/mental health-specific compliance requirements.
• JD or health-law background (not required, and not a substitute for operating experience — this is not a legal role).
• Familiarity with ONC Health IT Certification and information-blocking rules.

Benefits

• Medical, dental, vision, life & disability insurance.
• 401(k) plan with company match.
• Flexible Time Off (FTO), wellbeing days, paid holidays, and summer Fridays.
• Mental health resources.
• Paid parental leave & Backup Care.
• Tuition reimbursement.
• Employee Resource Groups (ERGs).