Lead Security & Compliance Analyst

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Lead Security & Compliance Analyst based in United States.

This role offers the opportunity to combine security governance expertise with hands-on technical security operations. You will own critical compliance programs while helping strengthen security practices across a growing healthcare technology environment. The position sits at the intersection of risk management, cloud security, audit readiness, and operational resilience. You will lead security frameworks, vulnerability management initiatives, and third-party risk processes while partnering with technical teams. Your work will directly support the protection of sensitive healthcare data and the reliability of digital solutions used by providers and patients. This is an impactful opportunity for a security professional who enjoys both strategic ownership and technical execution.

Accountabilities: The Lead Security & Compliance Analyst will be responsible for managing security compliance programs while actively contributing to technical security improvements. This role requires a balance of governance expertise, security operations knowledge, and the ability to collaborate across engineering, compliance, and external stakeholders.

Own end-to-end compliance audit activities, including SOC 1, SOC 2, HITRUST CSF, and HITRUST AI audits, from preparation and evidence collection through remediation and auditor coordination.

Develop, maintain, and improve security policies, procedures, and operational practices aligned with frameworks such as HIPAA, HITRUST, and SOC.

Manage compliance automation and trust management platforms, ensuring controls are monitored effectively and customer security requests are addressed efficiently.

Coordinate with external auditors, vendors, and customers to support security reviews, compliance validations, and assessment processes.

Lead third-party risk assessments and manage responses to customer security questionnaires and external security inquiries.

Deliver security awareness and compliance training while evaluating the effectiveness of internal controls.

Manage vulnerability management processes, including security scanning, vulnerability prioritization, remediation tracking, and collaboration with engineering teams.

Investigate and address security findings across cloud environments, including AWS services such as EKS, WAF, Shield, CloudFront, and IAM.

Review external attack surface findings and implement technical improvements related to security configurations, encryption, headers, and infrastructure protections.

Support security incident response activities, including log analysis, forensic evidence collection, investigation, and containment efforts.

Assist with fraud investigations and forensic reviews by analyzing authentication logs, extracting relevant data, and preserving evidence when required.

Improve security operations through automation, scripting, and process optimization using tools and technologies such as Python or Bash.

Requirements

The ideal candidate is a security professional with experience across governance, risk, compliance, and technical security operations. You should be comfortable managing audits while also investigating vulnerabilities, reviewing cloud security configurations, and driving remediation efforts.

4+ years of combined experience in security compliance, GRC, and hands-on technical security roles.

Proven experience supporting SOC 1, SOC 2, and/or HITRUST audits, including participation in a complete audit lifecycle.

Strong understanding of HIPAA Security and Privacy requirements.

Hands-on experience with vulnerability management, security scanning, remediation workflows, and interpreting technical findings such as CVEs and cloud misconfigurations.

Familiarity with AWS security concepts, including IAM, security groups, logging, monitoring, and web application security controls.

Ability to create clear security policies, procedures, remediation plans, and technical documentation.

Strong communication skills with the ability to collaborate with engineering teams, auditors, vendors, and business stakeholders.

Experience working with compliance automation platforms such as Drata, Vanta, or similar tools is preferred.

Background in healthcare or another regulated industry is a plus.

Security certifications such as CISSP, CISA, CRISC, HITRUST CCSFP, or CISM are highly valued.

Experience with SIEM platforms, log analysis, forensic investigations, fraud analysis, or legal/eDiscovery support is beneficial.

Benefits

Competitive base salary range of $80,000 to $135,000 USD , depending on experience and level.

Annual company-wide bonus opportunity of up to 15% based on company performance.

Equity incentive plan.

Comprehensive medical, dental, and vision coverage with flexible plan options.

Employer-funded Health Savings Account (HSA) contributions.

401(k) retirement plan.

Remote-first work environment with access to office and coworking space support.

Flexible vacation policy.

Additional paid summer Fridays.

Home office and wellness stipend.

Monthly internet stipend.

Annual learning and professional development stipend.

Opportunity to contribute to meaningful healthcare technology initiatives while working in a collaborative security-focused environment.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best!  Why Apply Through Jobgether?    Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.     #LI-CL1