Head of Security & IT

SuperDial

21h•Onsite

About The Position

SuperDial is hiring its first Head of Security & IT, a hands-on leader responsible for the company’s security, compliance, and corporate IT functions end to end. The role will set security strategy, run compliance programs, secure employees, devices, and vendors, and partner closely with Engineering on product security. The position is based in SuperDial’s San Francisco office. The reporting line is not specified; the posting contains a placeholder asking to confirm it. The role owns compliance programs including SOC 2 and HIPAA, audit readiness and evidence collection, security policies, and relationships with auditors and compliance vendors. It also manages corporate IT, including devices, identity and access management, SSO, VPN and endpoint protection, software and SaaS administration, and contractor-delivered IT support. The Head of Security & IT will implement and monitor security controls, conduct risk assessments, manage vulnerabilities, oversee security monitoring, and prepare and test incident-response plans. The role also owns security awareness training and the security aspects of onboarding and offboarding, coordinates penetration tests and remediation with Engineering, and manages third-party security assessments, vendor access and risks, and customer security questionnaires and reviews.

Requirements

7+ years in security, IT, or compliance, including at least 2 years leading a security or IT function.
Direct ownership of a SOC 2 audit from readiness through report; Type II is preferred.
Working knowledge of HIPAA security requirements and handling protected health information (PHI).
Hands-on experience administering IAM/SSO, such as Okta or Google Workspace, MDM, and endpoint protection tools.
Experience running vulnerability management, penetration-testing programs, and incident-response planning.
Experience assessing and managing third-party vendor risk.
Comfort working strategically and hands-on, including writing policies, configuring tools, and presenting to leadership.
Clear, confident communication with engineers, executives, auditors, and customers.

Nice To Haves

Experience as the first security or IT hire at a venture-backed startup.
Background in healthcare technology, revenue cycle management, or another regulated industry.
Familiarity with compliance automation platforms such as Vanta or Drata.
Exposure to cloud security (AWS or GCP) and AI/ML systems handling sensitive data.
Relevant certifications such as CISSP, CISM, CISA, or Security+.

Responsibilities

Own SuperDial’s compliance programs end to end, including SOC 2, HIPAA, and future frameworks as customer needs evolve.
Drive audit readiness and lead evidence collection across the company.
Write, maintain, and enforce security and compliance policies.
Manage relationships with auditors and compliance vendors.
Identify and close compliance gaps before they become customer or audit issues.
Manage company devices, identity and access management (IAM), and SSO.
Enforce VPN usage and endpoint protection on company devices.
Administer core software and SaaS tools, including provisioning and license management.
Oversee contractor-delivered IT support and hold vendors to service standards.
Design, implement, and monitor security controls across the company.
Run regular risk assessments and maintain the risk register.
Lead vulnerability management from identification through remediation.
Own security monitoring arrangements, in-house or through managed providers.
Build and test incident-response plans.
Run security awareness training for employees and contractors.
Own the security aspects of onboarding and offboarding in partnership with People Ops.
Ensure timely access provisioning and removal across systems.
Maintain documentation supporting onboarding and offboarding processes for audits.
Schedule and manage penetration tests and define testing scope with Engineering.
Track penetration-test findings and drive remediation to closure with engineering owners.
Partner with Engineering on secure development practices and remain accountable for the security program.
Run vendor security assessments before onboarding new tools and partners.
Manage vendor access controls and conduct ongoing reviews.
Track vendor-related risks and contractual security obligations.
Respond to customer security questionnaires and support security reviews in the sales process.