HIPAA COMPLIANCE & SECURITY OFFICER

THE POSITION

We are looking for a HIPAA Compliance & Security Officer to join an independent, remote-first healthcare technology and services firm.

In this role, you will serve as the primary interpreter and point of contact for all privacy and security questions across the organization. Working closely with leadership, engineering, and external partners, you will align our data protection policies with regulatory requirements, ensuring our infrastructure, cloud posture, and vendor relations maintain a bulletproof compliance standard.

You will oversee continuous risk analysis, incident response, and security documentation, fostering a high-performing culture of data privacy and organisational trust.

RESPONSIBILITIES:

• Regulatory Compliance & Policy Management: Act as the primary HIPAA interpreter and point of contact for all privacy and security questions. Prepare, run, and document regular privacy and security meetings while managing and organising all compliance-related documentation and policy reviews.

• Audits & External Liaison: Serve as the main liaison for external security and compliance auditors, managing end-to-end audit readiness and presenting required evidence.

• Risk Analysis & Remediation: Conduct the Annual Security Risk Analysis and meticulously track remediation efforts across all corporate and production systems.

• Incident Response & Breach Management: Own and maintain the Incident Response (IR) plan. Lead breach management processes, ensuring full compliance with the 60-day notification mandate in the event of an incident.

• Vendor & BAA Management: Oversee Business Associate Agreement (BAA) management, tracking vendor compliance postures, and ensuring all third-party processors meet strict regulatory standards.

• Infrastructure & Cloud Security Oversight: Drive infrastructure risk oversight by identifying, prioritising, and delegating security tasks to the engineering team.

• Conduct formal cloud security posture reviews and maintain comprehensive security architecture documentation.

TECHNICAL REQUIREMENTS:

• Compliance & Security Experience: 7+ years of proven experience in IT security, data privacy, or compliance roles, with a strong focus on healthcare regulations.

• Subject Matter Expertise: Deep, authoritative knowledge of HIPAA regulations, Privacy and Security Rules, and HITECH requirements.

• Risk & Audit Management: Demonstrated success leading formal risk assessments (e.g., Annual Security Risk Analysis) and managing HIPAA compliance/audit initiatives.

• Cloud & Infrastructure Knowledge: Working knowledge of cloud security posture management (AWS, Azure, or GCP) and the ability to effectively translate technical infrastructure risks into actionable requirements for engineering teams.

• Cross-Functional Mindset: Experience collaborating closely with Legal, HR, Operations, and Engineering teams to embed compliance into daily workflows.

ABOUT YOU:

• Strategic, pragmatic, analytical, and technical thinking.

• Highly organised, ability to prioritise tasks and detail-oriented.

• Exceptional judgment, tact, and decision-making ability.

• Flexibility to adjust to multiple demands, shifting priorities, ambiguity, and rapid change.

• Outstanding management and interpersonal skills.