Compliance and Security Director

Bluesight

3d•$155,000 - $170,000•Remote

About The Position

Bluesight is hiring a Director, Compliance and Risk to join its Legal team and report to the General Counsel. The role owns Bluesight’s compliance posture, including SOC 2 and HIPAA, its risk program, and customer-facing regulatory assurance. The director partners with the CTO/Security Officer and Security Engineering, which owns product security and IT, while leading and improving compliance programs and requirements. The position is responsible for the SOC 2 audit and certification process; risk assessment and risk-register management; third-party risk, business continuity and disaster recovery, and policy lifecycles; customer security reviews; and compliance evidence across cloud infrastructure and IT controls. The role also supports internal audits, employee training, compliance automation, and strategy for healthcare data security and AI. Applicants may be located in the continental United States. The listed base salary range is $155,000–$170,000 per year, with eligibility for an annual discretionary bonus.

Requirements

Experience developing, implementing, and monitoring internal practices for SOC 2, HIPAA, NIST, or ISO compliance standards.
Familiarity with hospital security operations and ability to credibly represent the company’s security posture and operational maturity to customers.
Working knowledge of cloud infrastructure and security, preferably AWS, including IAM, networks, encryption and key management, logging and monitoring, and the shared-responsibility model; ability to read architecture diagrams and challenge control claims.
Working knowledge of AI governance, such as the NIST AI Risk Management Framework or vendor AI risk, and proactive interest in AI regulation.
Ability to communicate complex and critical information clearly to a broad audience.
Subject matter expertise in security best practices and ability to recommend risk treatment and escalate items for acceptance.
Drive to learn unfamiliar domains and willingness to work across departments as product and data requirements evolve.
Autonomy and proactivity in driving work to completion amid ambiguity and across multiple stakeholders.
Strong familiarity with data, data protection, privacy, and compliance automation or GRC platforms such as Vanta or Drata.

Responsibilities

Lead and operate Bluesight’s SOC 2 compliance program and manage the annual audit and certification process.
Own the risk register, annual risk assessment, third-party/vendor risk, business continuity and disaster recovery, and policy lifecycles.
Engage with prospective and current hospital customers about security and IT questions and concerns.
Own the customer security review process, completing security and IT questionnaires and responding to technical questions and contract issues related to compliance and security.
Assess and document compliance controls across AWS cloud infrastructure, working with Engineering to validate configurations, access controls, logging, encryption, and shared-responsibility boundaries for SOC 2 and HIPAA evidence.
Partner with IT on endpoint protection, identity and access management, and access reviews, and own related audit evidence.
Set up and extend the compliance automation platform.
Conduct internal audits, train employees, and advise on security and compliance across Bluesight.
Shape and communicate compliance strategy, particularly at the intersection of healthcare data security and AI.
Document work and decision-making processes and lead presentations and discussions for broad audiences.
Uphold a culture of collaboration, transparency, creativity, inclusion, and data-driven decisions.