Director of Security & Compliance

Verse Medical•New York, NY

2d•$220,000 - $270,000•Hybrid

About The Position

Verse Medical is a well-funded Series C company aiming to modernize healthcare communication by building a software infrastructure that connects providers, payors, and patients. They are seeking a Director of Security & Compliance to establish and lead their security program. This role involves defining security architecture, leading HITRUST certification, protecting patient data, and acting as a hands-on player-coach. The ideal candidate will have high ownership, experience building security programs from the ground up, and serve as the senior-most security voice in a fast-growing company.

Requirements

8+ years in security, compliance, or information security, with at least 2–3 years as a senior leader or subject matter expert at a startup or growth-stage company
Direct experience owning HIPAA, HITRUST, and/or SOC 2 compliance end to end — designing, implementing, operating, and auditing the relevant security controls and policies
Experience leading incident response, from detection through remediation and postmortem
Experience designing and implementing both technical and non-technical security controls: MDM, IAM, endpoint protection, access policies, vulnerability management
Strong cross-functional communication: able to explain risk and compliance requirements to executives, work credibly alongside engineers, and represent our posture to enterprise customers and auditors
Comfort operating as a player-coach — willing to be hands-on-keyboard while building the function

Nice To Haves

Track record of building security programs from early maturity: you've written the first policies, stood up the first tooling, and made pragmatic risk tradeoffs rather than inheriting a mature program

Responsibilities

Own and drive the company-wide security strategy and roadmap, balancing risk reduction with the speed of a Series C product organization
Serve as the owner for HIPAA compliance and our ongoing HITRUST certification effort, implementing and operating the underlying controls
Serve as the senior-most security voice in the company, advising executive leadership on risk posture, security investments, and tradeoffs
Implement and operate technical security controls: vulnerability management, endpoint protection, logging and monitoring, detection and response
Lead incident response, including playbook development, on-call structure, tabletop exercises, and post-incident reviews
Build the security team over time, starting as a hands-on player-coach and hiring once the program scales