Security & Compliance Lead

Maigrate•Lawrence, NY

7d•$160,000 - $200,000•Hybrid

About The Position

Maigrate is seeking its first dedicated security and compliance owner to build and lead the company's security program from the ground up. This role will serve as the designated HIPAA Security Officer and will be responsible for establishing the security and compliance foundation, including leading SOC 2 readiness, building the policy and control framework, and implementing systems to manage security as the company scales. A unique aspect of this role involves addressing the security challenges posed by AI and large language models, including data handling, logging, retention, and AI system monitoring. The successful candidate will define technical security standards, manage access control, cloud security, vulnerability management, endpoint security, and incident response. Additionally, they will set AI security and governance controls, support customer security reviews, manage vendor risk, and deliver security training. The role also involves developing the annual security and compliance budget and presenting priorities to the CEO.

Requirements

6+ years in security, compliance, or a comparable role
You have built a security and compliance program from the ground up in a cloud SaaS environment, including taking SOC 2 from readiness through audit
Working HIPAA knowledge from the business associate side, including PHI handling, BAAs, security risk analysis, and breach response
Strong cloud security skills. You are comfortable getting into the environment yourself, investigating findings, and working directly with engineering to remediate them
Experience with identity and access management, vulnerability management, logging, endpoint security, and incident response
Ability to turn a control requirement into clear instructions an engineer will actually follow
Comfort speaking directly with customer security and compliance teams
Ability to operate in an early-stage environment where the program is still being built

Nice To Haves

CISSP, CISA, or HCISPP
Experience securing LLM-based or AI-native products
HITRUST or NIST framework experience
Experience working with healthcare SaaS companies
Experience supporting security and compliance requirements for customers in regulated financial services environments

Responsibilities

Build the compliance program
Serve as Maigrate's designated HIPAA Security Officer
Own the HIPAA security program, including security risk analysis, risk management, policies, controls, and documentation
Lead SOC 2 readiness through Type II and manage the audit process end to end
Write and maintain the security policy set and make sure the company follows it
Run our GRC platform, such as Vanta or Drata, and automate evidence collection wherever possible
Track findings, remediation work, and ongoing compliance requirements
Set and enforce technical security standards
Define access control, identity, and least-privilege requirements, and verify engineering enforces them across cloud and SaaS systems
Set security standards for our cloud environment and hold the company to them
Own vulnerability management as a program: define the process, prioritize findings, and drive engineering to close them
Set requirements for endpoint security, monitoring, and logging, and confirm coverage is real
Coordinate penetration testing and drive findings through remediation
Investigate findings directly in the environment when you need to understand what is actually happening
Set security requirements for business continuity, backups, and disaster recovery
Own incident response
Build and maintain the incident response plan and test it before we need it
Lead the response when a security incident happens
Own incident investigation, documentation, and post-incident remediation
Coordinate breach assessment and required notifications under HIPAA, applicable BAAs, and applicable state breach notification requirements
Set the AI security and governance controls
Define what data may reach an AI model and what must be de-identified or removed first
Ensure PHI is only shared with model providers under appropriate HIPAA-compliant arrangements
Review model providers for data retention, training, logging, security, and subcontractor risks
Set logging, retention, access, and review standards for prompts and outputs
Define the controls and fallback requirements for when AI systems fail or behave unexpectedly, and work with product and engineering on implementation
Answer customer security questionnaires and lead customer security and compliance reviews
Own the security and compliance requirements around BAAs and our subcontractor chain, working with counsel where needed
Run vendor security and risk reviews before we adopt systems that touch customer or company data
Maintain the security documentation customers need during diligence
Deliver security training people actually remember
Develop the annual security and compliance budget, recommend tooling and outside spend, and present priorities to the CEO for approval