Cybersecurity Lead

PATRIOTCLAIMS LLC• US,

2d•$110,000 - $130,000•Remote

About The Position

You'll work alongside our CISO as the hands-on leader of security execution, owning the implementation of our security strategy end to end. You'll design and deploy our security control framework, build our detection and incident response capabilities, and drive HIPAA compliance across the organization — from technical safeguards in our platform to administrative policies and workforce training. This is a builder's leadership role that combines strategy with engineering. You'll help shape the roadmap with the CISO, then make it real — building tooling and automations yourself where off-the-shelf solutions don't exist, and coordinating closely with engineering on everything else.

Requirements

7+ years in information security, with 2+ years leading security programs or teams
Bilingual English/Spanish proficiency (fluent in verbal and written communication in both languages)
Hands-on experience securing cloud-native SaaS platforms, with log management or SIEM tooling experience
Scripting skills (Python, Bash, or similar) and comfort working with APIs to build custom integrations and tools
Track record implementing a security framework like (NIST CSF, NIST AI RMF, ISO 27001) and conducting formal risk assessments
Strong communication skills — able to translate risk for executives, engineers, and non-technical staff
Willingness to learn and build in a startup environment

Nice To Haves

Direct experience building or running HIPAA compliance programs in a healthcare, healthtech, PHI-handling environment or PCI-SSC
Experience with GCP and Cloudflare
Experience with compliance automation platforms like Vanta, Drata, among others
Bilingual Spanish/English
Certifications like,CSFPC, CompTIA Security+

Responsibilities

Partner with the CISO to define and execute VetClaims' security strategy, roadmap, and priorities
Design, implement, and operate security controls across cloud infrastructure, applications, and corporate systems — encryption at rest and in transit, access controls, audit logging, and data retention
Establish secure SDLC practices with engineering: security code review standards, dependency scanning, secrets management, and PHI data-handling patterns
Design, implement, and maintain centralized logging across our infrastructure (GCP, Cloudflare, application logs, and others)
Evaluate, implement, and manage SIEM or log management tooling
Create, tune, and maintain security alerts for critical events; build monitoring for suspicious activity, unauthorized access, and anomalies
Review and analyze Cloudflare analytics and threat data, and track threats targeting our platform
Lead investigation and response for security incidents, and create and own incident response playbooks.
Evaluate, implement, and maintain security scanning tools, including container and dependency scanning
Prioritize vulnerabilities and coordinate remediation with engineering
Build custom integrations for vulnerability tracking and remediation workflows
Implement monitoring and alerting for role changes, privileged access, and access anomalies. Suggest improvements in access and identity management across all our tech stack.
Support HIPAA compliance end to end: administrative, physical, and technical safeguards under the Security Rule, Privacy Rule alignment, breach notification procedures, and ongoing risk assessments
Conduct and maintain the HIPAA-required security risk analysis and drive remediation of gaps
Build and maintain Vanta integrations, developing custom solutions where standard integrations don't exist
Collect and manage evidence for audits and compliance reviews
Support Business Associate Agreements and third-party/vendor risk, including payments, CRM, and communications integrations
Support security and privacy awareness training for all staff
Design and build security automations to reduce manual work
Develop custom tools and integrations where off-the-shelf solutions fall short
Maintain and continuously improve the security tooling stack