Security Compliance Director

The Security Compliance Director will function as 1upHealth’s Security Officer and will play an integral role in defining and assessing the organization's security strategy, architecture and practices and designing a security program that is tailored to support 1upHealth’s business needs. Reporting to the VP, Chief Information Security Officer, the Security Compliance Director will work with all relevant internal stakeholders to determine business objectives and acceptable levels of risk for the organization, and to effectively translate those business objectives and risk management strategies into specific security policies and processes that ensures compliance with all  regulatory, legal and contractual requirements.

1up's core product is a fully-managed FHIR platform that brings modern data infrastructure (cloud-based, serverless, restful API, and more) along with the FHIR interoperability standards to help transform the industry.  1up sells across all segments - health plans, providers, pharma, digital health companies, and more.  

In this role, you’ll get to:

• Develop, implement, and monitor a strategic, comprehensive security program (including all required policies and processes) that is tailored to 1upHealth and that  ensures appropriate levels of confidentiality, integrity, availability, safety, privacy, and recovery of information assets owned, controlled, stored, or/and processed by the organization. 
• Manage audit programs (SOC 2, HITRUST, others), oversee evidence collection and submission, framework changes, and remediation of any corrective actions. 
• Create a risk-based process for the assessment and mitigation of any security risk in the ecosystem consisting of supply chain partners, vendors, consumers and any third parties.
• Manage AI governance program, developing standards and conducting assessments on technology and product features.
• Collaborate and coordinate with the Chief Technical Officer and other relevant internal stakeholders  on the product and engineering teams to ensure that security requirements are implicit in all internal processes and security is embedded into all product delivery and development processes, by providing the appropriate policies, practices, and guidelines.
• Lead the security risk management function across the company to ensure consistent and high-quality information security management in support of the business goals.

• Develop and maintain a document framework of continuously up-to-date information security policies, standards and guidelines. 
• Create a framework for roles and responsibilities about information ownership, classification, accountability and protection of information assets.
• Develop and lead best practices for business continuity planning, high availability and resiliency of mission critical services.
• Support an ongoing communication plan and security awareness training program to educate and train employees, as well as, security and technology stakeholders, on the purpose and benefits of a Security Program.
• Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, increase the maturity of the information security, and review it with relevant internal stakeholders. 

• Provide support to customer facing teams to ensure that all security requirements in commercial contracts are consistent with 1upHealth’s internal processes and policies.

We are looking for people who have:

• Bachelor’s degree in computer science or engineering or the equivalent combination of education, training, or work experience. 
• 8+  years of IT security , Security Architecture, and Security compliance and governance experience, preferably at a health tech organization.
• Experience with assessment, development, implementation, optimization, and documentation of a comprehensive and broad set of security technologies and processes (secure software development (Application Security), data protection, cryptography, key management, identity and access management (IAM), network security) within SaaS, IaaS, PaaS, and other cloud environments
• Requires an advanced level of competency in risk management, security, regulatory compliance, and privacy practices., including advanced knowledge and comprehension of risk assessment and acceptance, exception management and security baselines (e.g., CIS Baselines, NIST, vendor security technical implementation guides, etc.)
• Strong interpersonal and communication skills; ability to work in a team environment
• Broad understanding of healthcare trends - and a genuine curiosity to learn more
• High energy-level, and highly adaptable in a startup environment
• Ability to thrive in ambiguity 
• 100% self-starter mindset