[Hiring] Senior Security & Compliance Lead @Zenara Health

Role Description

We are looking for a Senior Security & Compliance Lead to build and own Zenara’s security and compliance program.

• Set risk priorities, define security and HIPAA-related controls, verify their effectiveness, and lead responses to customer security reviews.
• Work closely with the Head of Engineering and the Platform Engineer to turn security requirements into working practices.
• Inspect technical environments, identify key risks, explain trade-offs, and collaborate with engineers to implement and verify effective controls.
• Build a program with clear control owners, practical policies, current evidence, tracked remediation, and tested response procedures.
• Your remit includes:
  • HIPAA-related safeguards, policies, and evidence
  • Security risk assessment and remediation priorities
  • Technical control standards and verification
  • Patient-data flows and access controls
  • Vendor and AI-tool risk
  • Customer security reviews and audit preparation
  • Incident response and escalation procedures
  • Security practices for AI-assisted engineering

Qualifications

• Senior-level healthcare security and compliance experience, including substantial HIPAA expertise.
• Verifiable examples of security or compliance programs, safeguards, or reviews you have led.
• Hands-on technical security knowledge across cloud infrastructure, access control, secrets, and data protection.
• Ability to assess a real technical environment—not only review policies.
• Experience establishing or improving security practices in a small or growing organization.
• Ability to translate risks and requirements into controls engineers can implement and operate.
• Experience guiding engineers while independently assessing whether their controls work.
• Clear written communication about risks, decisions, priorities, and practical next steps.
• Judgment about what to address immediately, what to plan for, and when to escalate.

Requirements

• Relevant Areas:
  • HIPAA and healthcare data security
  • Azure cloud and AKS / Kubernetes security
  • Access and secrets management
  • Patient-data flows and technical safeguards
  • Vendor and AI-tool risk
  • Customer security reviews
  • Control evidence and audit preparation
  • Incident response
  • Security roadmap prioritization

Nice to Have

• SOC 2 or HITRUST experience
• Azure security experience
• Experience building a program at an early-stage startup
• Experience assessing AI/LLM vendors and agent access to sensitive data

Benefits

• Competitive compensation, based on demonstrated expertise and experience
• Fully remote work
• Equipment allowance
• Direct access to the founder and Head of Engineering
• Significant ownership of the security and compliance foundations of an AI-native healthcare company

What Success Looks Like

• In your first 30 days, review the current environment with the Platform Engineer, identify the highest-priority security and compliance gaps, clarify control ownership, and establish a practical remediation plan.
• Within 90 days, core HIPAA-related policies and controls will have assigned owners and supporting evidence. Priority findings will be tracked to resolution.
• Over time, Zenara will maintain a security and compliance program: current evidence, tested incident procedures, tracked exceptions, clear ownership, and the ability to respond confidently to customer security reviews.

Who Will Thrive in This Role

• This role is well suited to someone who:
  • Has real healthcare security and HIPAA experience.
  • Can combine policy knowledge with technical review.
  • Enjoys building a program and developing the people who operate its controls.
  • Prioritizes clearly instead of treating every finding as equally urgent.
  • Follows through from recommendation to implementation and verification.
  • Can balance startup speed with disciplined protection of patient data.
• You may struggle if you prefer to advise from a distance, produce generic documentation without verifying implementation, or need a large established security team and budget to make progress.