Head of Security & Compliance

Knit Health•San Francisco, CA

About The Position

Knit Health is hiring its first in-house security leader to build and lead the company’s security and compliance function. The role will own the security strategy and roadmap for a venture-backed healthcare AI company handling sensitive clinical data, represent Knit to customers, auditors, partners, and health-system security reviewers, and personally execute early-stage program work. The role leads cross-functional contributors in operations, engineering, IT, and external partners, without direct management authority, and may build a dedicated security team as the company grows. The position will build on Knit’s completed SOC 2 Type 1 and first Type II audit period, lead the next stage of HIPAA compliance, and assess whether and when to pursue HITRUST certification. It will implement and validate security program foundations across access management, vendor risk, endpoint and cloud configuration, monitoring, incident response, and data protection. The role also owns the security and compliance budget and safeguards for clinical, PHI, and other sensitive data, including across AI/ML products, AI-assisted development workflows, and data pipelines.

Requirements

Prior experience as a senior security leader at a healthcare technology or health data company of roughly 50–1,000 people, owning a program subject to enterprise customer, audit, and regulatory demands.
Direct ownership of a HIPAA program and a SOC 2 Type II or comparable audit, such as HITRUST or ISO 27001, including hands-on evidence, policy, questionnaire, and contract review work.
Strong working knowledge of cloud security (AWS, Azure, or GCP), identity and access management, and common SaaS security tooling.
Ability to directly review code and infrastructure.
Experience representing security to external audiences, completing security questionnaires, and leading review calls.
Excellent written and verbal communication skills, including the ability to translate technical risk into actionable terms for non-technical audiences.
Comfort operating autonomously in a fast-moving, resource-constrained startup environment and building directly as a team of one.
Track record of driving security outcomes through cross-functional teams not directly managed, including engineering and IT, and resolving competing priorities through planning and collaboration.

Nice To Haves

Experience securing AI/ML systems, LLM-based products, or data pipelines feeding machine learning models.
Knowledge of Python, SQL, and Terraform.
A relevant security certification such as CISSP or CISM; demonstrated hands-on experience is valued more than credentials.
Experience transitioning a company from an outsourced or fractional security function to an in-house program.

Responsibilities

Own Knit’s security strategy and roadmap, setting priorities based on the company’s stage, risk profile, and growth plans.
Represent Knit’s security program to customers, prospects, auditors, and partners; complete security questionnaires, lead security reviews, and support sales and diligence conversations.
Build a security-aware engineering culture through data-handling guidance, secure-coding training, and accessible consultations.
Advise leadership, investors, and the board on security risks, incident readiness, and compliance posture.
Own compliance programs, build on SOC 2 Type 1 and Type II work, and lead the next stage of HIPAA compliance.
Gather, organize, and validate audit evidence; run control testing; and manage certification and renewal cycles.
Create and maintain security policies, procedures, and control documentation.
Lead evaluation of whether and when to pursue HITRUST certification.
Design and implement practical security program foundations, including access management, vendor risk reviews, endpoint and cloud security configuration, logging and monitoring, and incident response plans.
Audit and validate cloud, development systems, SaaS tools, and data pipelines, and work with platform engineering and IT/SecOps partners to drive fixes.
Own the security and compliance budget, including tooling, vendors, training, and contracted audit support.
Own and maintain the incident response program, train incident commanders, and lead incidents from detection and triage through resolution and required customer or regulatory notifications.
Ensure appropriate safeguards for clinical, PHI, and other sensitive data, including in AI/ML products, AI-assisted development workflows, and data pipelines.
Conduct ongoing risk assessments and vendor security reviews, and manage third-party risk as partner and data-provider relationships grow.

Benefits

Competitive compensation package including base salary, equity, and opportunities for advancement.
Medical, dental, and vision coverage, with 100% of premiums paid for employees and dependents; full coverage for dental, vision, and the Gold medical plan, with the option to buy up to Platinum.
Coverage begins on the first day of employment.
401(k) plan.
24 days of PTO annually.

Stand Out From the Crowd

Upload your resume and get instant feedback on how well it matches this job.

Upload and Match Resume