AI Security & Healthcare Compliance

Role & responsibilities:

• Own the AI Security, Privacy, and Compliance framework for AI/GenAI solutions across the organization, with particular focus on healthcare data and regulated workloads.
• Ensure AI solutions handling PHI/PII comply with applicable healthcare security and privacy requirements, including HIPAA and organizational security policies.
• Define secure patterns for interactions with foundation models, open-weight models, third-party model providers, AI SaaS platforms, and external APIs.
• Define and maintain the organizations AI risk assessment and production approval process, ensuring security and compliance requirements are addressed before deployment.
• Evaluate third-party AI vendors and models from a security, privacy, compliance, data usage, and contractual risk perspective.
• Work closely with Legal, Compliance, Privacy, Enterprise Security, Product, Platform, and AI Engineering teams to translate regulatory requirements into practical engineering controls.
• Maintain security evidence, risk assessments, architecture decisions, control documentation, and audit artifacts required for internal and external compliance reviews.

Qualifications/Criteria:

• Bachelors or Masters degree in Computer Science, Information Security, Cybersecurity, Engineering, or a related technical discipline.
• Strong foundation in cloud/application security and modern AI technologies.
• 7+ years of overall technology/security experience, with significant experience in application, cloud, product or cybersecurity.
• 5+ years of experience designing or implementing security controls for cloud-native or enterprise applications.
• Practical exposure to Generative AI/LLM applications, including RAG, agents, foundation models, vector databases and model APIs.
• Prior healthcare/HIPAA experience is strongly preferred.
• Experience establishing security practices for a new AI platform, product, or organizational capability would be highly valuable.
• Demonstrated experience working with regulated or sensitive-data environments, preferably healthcare, financial services, insurance or similar industries.
• Healthcare security/privacy certifications such as HCISPP or equivalent are preferable.
• Training/certification in AI security, responsible AI, NIST AI RMF or cloud AI security is desirable.