Head of Security & Compliance

Knit Health • San Francisco, CA

2d • $230,000 - $265,000

About The Position

Knit Health is building a novel clinical foundation model to improve how healthcare is delivered. We combine expertise in AI with deep clinical knowledge to develop safe, trustworthy systems that improve care, expand access, and reduce waste. Knit is led by a founding team with roots at the University of California, Berkeley. The team has developed a novel AI architecture designed to reason like physicians. We are now using that foundation model, together with frontier clinical LLMs, to build a next-generation clinical intelligence platform for healthcare providers. We are venture backed and work with U.S.-based health systems and data providers.

Security and compliance are core to Knit Health's ability to earn the trust of health systems, partners, and patients. We’re bringing on our first enterprise customers, starting with pilots. We've relied on an outsourced virtual CISO, alongside our operations, engineering, and IT teams, to build the foundation. It's now time to bring that leadership in-house. We’re looking for a hands-on security leader who sets the security vision and roadmap, represents Knit credibly to customers, auditors, and health-system security reviewers, and personally does the early-stage work of building the program: writing policies, gathering audit evidence, configuring and writing tools, and closing gaps. You’ll lead a cross-functional team spanning operations, engineering, IT, and external partners. These team members don’t report to you directly, but you’ll own the security outcomes they deliver. As the company grows, you’ll have the opportunity to build out a dedicated security team. This is a rare opportunity to build a security function from the ground up at a fast-moving, venture-backed healthcare AI company, with real influence over how Knit scales its security and compliance posture and what it means for clinical AI to be trustworthy.

Requirements

• Prior experience as a senior security leader at a healthcare technology or health data company of roughly 50 - 1,000 people, owning a program with real external demands: enterprise customers, third-party audits, and regulatory requirements.
• Direct ownership of a HIPAA program and a SOC 2 Type II (or comparable, such as HITRUST or ISO 27001) audit, including personally doing evidence, policy, questionnaire, and contract review work, not only overseeing it.
• Strong working knowledge of cloud security (AWS, Azure, or GCP), identity and access management, and common SaaS security tooling, including the ability to directly review code and infrastructure.
• Experience representing security to external audiences (customers, auditors, or partners) including completing security questionnaires and leading review calls.
• Excellent written and verbal communication skills, with the ability to translate technical risk into terms a non-technical audience (leadership, customers, sales) can act on.
• Comfortable operating with significant autonomy in a fast-moving, resource-constrained startup environment. You’re comfortable building directly and energized by being a team of one.
• Track record of driving security outcomes through cross-functional teams you don’t directly manage, including engineering and IT, and resolving competing priorities through planning and collaboration.

Nice To Haves

• Experience securing AI/ML systems, LLM-based products, or data pipelines feeding machine learning models.
• Knowledge of Python, SQL, and Terraform.
• A relevant security certification (e.g., CISSP, CISM, or similar), though we care more about demonstrated hands-on experience than credentials.
• Prior experience transitioning a company from an outsourced or fractional security function to an in-house program.

Responsibilities

• Own Knit's overall security strategy and roadmap, setting priorities that match our stage, risk profile, and growth plans as a healthcare AI company handling sensitive clinical data.
• Serve as Knit's security executive to customers, prospects, auditors, and partners, credibly answering security questionnaires, leading security reviews, and representing the program in sales and diligence conversations.
• Build a security-aware engineering culture: clear guidance on what data can go where, training on secure coding, and fast, lightweight consults so engineers know when to stop and ask.
• Advise leadership, investors, and the board on security risk, incident response readiness, and compliance posture in plain, business-relevant terms.
• Take ownership of our compliance programs, building on our completed SOC 2 Type 1 and first Type II audit period, and lead the next stage of HIPAA compliance as we move more workloads into our own environment.
• Gather, organize, and validate audit evidence, run control testing, and manage the mechanics of certification and renewal cycles.
• Build and maintain the policies, procedures, and documentation that our controls rely on, and keep them current as the company evolves.
• Lead the evaluation of whether and when Knit should pursue HITRUST certification.
• Design and implement the practical building blocks of a security program at an early-stage company: access management, vendor risk reviews, endpoint and cloud security configuration, logging and monitoring, and incident response plans.
• Audit and validate our cloud, development systems, SaaS tools, and data pipelines; our platform engineers and IT/SecOps partners build and operate the systems; you verify it and drive fixes, rolling up your sleeves alongside them rather than only directing.
• Own the security and compliance budget, including tooling (e.g., GRC platforms, vulnerability scanning), vendors, training, and contracted audit support, choosing what fits a lean, high-growth team.
• Own the incident response program: keep the plan current and effective, train incident commanders, and lead response from detection and triage through resolution and any required customer or regulatory notification.
• Ensure appropriate safeguards are in place for handling clinical, PHI, and other sensitive data, including with respect to our AI/ML products, AI-assisted development workflows, and data pipelines.
• Run ongoing risk assessments and vendor security reviews, and manage third-party risk as Knit's partner and data-provider relationships grow.

Benefits

• medical, dental, and vision coverage with 100% of premiums paid for employees and dependents (full coverage for dental, vision, and our Gold medical plan; employees may choose to buy up to Platinum); coverage begins on the first day of employment.
• 401(k) plan
• 24 days of PTO annually

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed