Security & Compliance Manager

Healthie is an AI-Native, ONC Certified EHR for modern outpatient healthcare. 

Healthie is proud to power clinically excellent healthcare for over 40,000 providers who deliver clinically excellent healthcare - longitudinal and collaboratively, with patient and provider experiences at the center. Both healthcare and technology are undergoing unparalleled industry innovation, and it’s incredible to see the momentum - from consumers, from providers, and from reimbursement for this type of healthcare - grow exponentially. 

We provide the powerful infrastructure every care delivery organization needs. On the surface this includes EHR, Scheduling, Engagement, Billing, Data, and much more. Underneath the iceberg are thousands of configurations, settings, widgets, automations, and limitless capabilities because we are an API-first platform. Our fully brandable platform makes it easy for clinics and organizations of any size to scale and never reach a limit. 

Today, over 3 billion API calls are made to Healthie every month, as thousands of organizations who work with more than 21 million patients in total, rely on Healthie to deliver clinically excellent healthcare in over 35 specialties, from behavioral healthcare to complex chronic care management and personalized medicine.

We believe in the power of technology to improve access to healthcare and we’re building the rails that make this a reality. We work fast and with quality because we provide business-critical, healthcare-critical software that clinicians and patients need for a better healthcare system. We’re customer-obsessed, operate with lightning-fast processes and responses, and always share our product roadmap publicly-  so customers can see what we’re building, and remain relentlessly focused on how care gets delivered.

Healthie is backed by leading investors, and while we've $42M raised to date, more importantly, we operate with fiscal responsibility and have been profitable for more than half of our time as a company. We know that building an ONC-Certified EHR is a lifetime’s body of work, and we are here to build for our customers forever.

Learn more at https://www.gethealthie.com/

As Manager, Security and Compliance, you'll run meaningful portions of the day-to-day security and compliance program at Healthie as a core member of Healthie’s Security and Compliance Team. You will own components of our audits, our third-party risk program, our customer-facing security work, and the policies and controls underneath all of it.

This is a builder's role. Some of what we need exists and needs to be run better. Some of it doesn't exist yet. You'll help decide what to fix first, design the process, pick or configure the tooling, and then run it until it works without you watching. You'll work with engineering, IT, operations, legal, sales, and the offices of the CEO and CTO, and report to Healthie’s VP of Security & Compliance. Many of the people you depend on won't report to you, so you'll need to get things done through influence and clear communication.

The work will include:

• Our third-party audits, including SOC 2, the annual HIPAA assessment, and HITRUST. You will scope the work, assign evidence to control owners, and close findings.
• Running the third-party risk management program. That covers vendor intake and tiering, security assessments, contract requirements such as BAAs, remediation tracking, and periodic reassessment. Vendors that touch PHI get the most attention.
• Owning the customer trust function: security questionnaires, customer audits, trust center content, and security reviews during enterprise deals. You'll join sales calls when a prospect's security team wants to talk to someone who knows the answers, and you'll refine the existing answer library so most questionnaires never need you.
• Contribute to the policy set, the control framework, and the risk register. You keep them accurate and mapped across frameworks, and you make sure people can follow them.
• Administering Vanta and the workflows around it, so continuous monitoring actually leads to fixes instead of a growing list of failing tests.
• Help with AI governance and data privacy practices. That includes reviews of AI features and AI vendors, privacy-by-design input on product work, and tracking state privacy laws, GDPR, and the EU AI Act as they apply to us.
• Running intake and triage for every request that comes to security and compliance. You set the priorities, answer what you can, and route the rest to the right owner with a deadline.
• Reporting program health to the VP and to leadership. You should be able to say where we are exposed, what is late, and what it will take to fix it.

Healthie participates in e-verify.

Healthie is committed to equal employment opportunity. All qualified applicants will receive consideration for employment without regard to and will not be discriminated against based on age, race, gender, color, religion, national origin, sexual orientation, gender identity, veteran status, disability or any other protected category. We're proud to be building a diverse and inclusive environment that encourages collaboration, creativity, and growth. Whatever your background, please apply if this is a role that would make you excited to come into work every day.