Security & Compliance Manager (GRC), US-based

Before you apply

Job source

Himalayas

Applying on

himalayas.app

Workplace

Fully remote

US state

Nationwide remote

Category

Accounting

Link last checked

Not checked yet

Posted

1 hour ago

Closes

11/18/2026

1. 1. Tailor your resume to this posting — it takes about a minute and noticeably improves your match score.
2. 2. Click One-Click Apply. We open the posting directly on himalayas.app in a new tab — Remote Me never charges for or intermediates an application.
3. 3. Create or sign in to the employer's applicant account, upload your resume, and submit their form.
4. 4. Come back and hit Save so this role stays in your dashboard — we'll notify you if the posting closes or the link breaks.

About the role

About Collectly Collectly is a patient billing and payments platform for US healthcare providers. We handle protected health information and card payments at scale, integrate directly with major EHRs, and sell to health systems and large provider organizations buyers with real security programs and real diligence processes. We're HITRUST i1 Validated and SOC 2 Type 2. The role You'll own security and compliance end to end. Today it's split between the CTO and whichever engineer happens to be nearest. You'll take all of it. You'll be the only person in this function, so the job is to build a program that scales without adding drag. Automate the evidence, delete the controls nobody can trace to a requirement, and answer the hard customer questions yourself instead of routing them to engineering. What you'll own Customer-facing security and compliance The largest part of the job. Answering customers’ security questionnaires AI governance questionnaires and responsible-AI reviews covering our AI patient billing agent Live security calls with prospects' InfoSec teams — technical conversations, not slide reading Health-system procurement portals (Archer, ProcessUnity, Venminder and similar) Annual customer reattestation cycles Customer security escalations, incident communications, and customer-facing RCAs Hosting customers who exercise right-to-audit clauses Distribution of SOC 2, HITRUST certification, pen test summaries, and subprocessor notices under NDA A public trust center, standard security package, and answer library — so most of the above becomes a lookup rather than a project Audits and certifications HITRUST i1 and SOC 2 Type 2, end to end: readiness, evidence, auditor management, remediation tracking PCI DSS: SAQ ownership, AOC collection from processors, scope definition for card-present and card-not-present flows Annual HIPAA Security Risk Analysis and risk register Pen test lifecycle: scheduling, scoping, remediation tracking, customer-facing summary Quarterly user access reviews BCP/DR tabletops and annual test coordination Compliance tooling Own Vanta and our security scanners as an administrator Pull evidence from systems — CI, infrastructure-as-code, identity provider, EDR, cloud config — instead of collecting screenshots Reduce the count of manually evidenced controls every year Contracts, BAAs, and vendor risk BAAs in both directions, customer and subcontractor, from template through negotiation Security exhibits, DPAs, subprocessor inventory Tiered vendor security review, so a no-PHI vendor gets a one-page checklist and a same-day answer Annual vendor reattestation Policies, training, and incident response Own and maintain the policy set Security awareness and HIPAA training, phishing simulations, completion tracking Own the incident response program: runbooks, tabletops, coordination during an incident Breach notification clock management — the HIPAA window, state AG requirements, cyber insurance notice, and the per-contract customer notification windows in our MSAs A documented exception process with a named approver, expiry date, and compensating control Privacy and AI governance HIPAA Privacy Officer designation State privacy law tracking: CCPA/CPRA, Washington My Health My Data, and what follows Stand up a durable AI governance framework for our AI patient billing agent — model inventory, human oversight, monitoring — replacing today's per-customer, from-scratch approach Track emerging state rules on AI in healthcare and AI-generated patient communications What you won't own Remediation engineering. Findings and fixes belong to DevOps. You own the SLA dashboard and the escalation path. Shipping decisions. You document risk and escalate. The CTO decides on the priority. A seat as a gate in design or code review. What we're looking for Extensive experience in security compliance or GRC, including time in healthcare SaaS or another PHI-handling environment Has run SOC 2 and HITRUST as an owner, not a contrib

Collectly is hiring remote talent through Remote Me. All listings are vetted for legitimacy.