Security & Compliance Manager, GRC

Job not on LinkedIn

🔥 5 minutes ago

🇺🇸 United States – Remote

💵 $190k - $220k / year

⏰ Full Time

🟡 Mid-level

🟠 Senior

🚔 Compliance

👻 Ghost score 9%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Collectly

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2017

🏥 Healthcare

⚕️ Healthcare Insurance

💳 Fintech

Healthcare • Healthcare Insurance • Fintech

Collectly is a healthcare technology company that provides an AI-powered financial assistant designed to streamline the medical billing process for patients. The platform helps healthcare providers improve patient engagement by making it easier for them to understand and pay their medical bills, resulting in faster collections and better patient satisfaction. Collectly integrates with existing electronic health records and practice management systems, allowing healthcare organizations to enhance their billing processes without changing their current software solutions.

📋 Description

• Own security and compliance end to end as the sole person in the function • Build a scalable security and compliance program without adding unnecessary operational drag • Answer customer security questionnaires • Complete AI governance questionnaires and responsible-AI reviews for the AI patient billing agent • Lead live security calls with prospects’ InfoSec teams • Manage health-system procurement portals, including Archer, ProcessUnity, and Venminder • Manage annual customer reattestation cycles • Handle customer security escalations, incident communications, and customer-facing RCAs • Host customers exercising right-to-audit clauses • Distribute SOC 2, HITRUST certification, penetration-test summaries, and subprocessor notices under NDA • Create and maintain a public trust center, standard security package, and answer library • Own HITRUST i1 and SOC 2 Type 2 readiness, evidence, auditor management, and remediation tracking • Own PCI DSS SAQs, collect processor AOCs, and define scope for card-present and card-not-present flows • Conduct the annual HIPAA Security Risk Analysis and maintain the risk register • Manage the penetration-test lifecycle, including scheduling, scoping, remediation tracking, and customer-facing summaries • Conduct quarterly user access reviews • Coordinate BCP/DR tabletops and annual testing • Administer Vanta and security scanners • Pull evidence from CI, infrastructure-as-code, identity provider, EDR, and cloud configuration systems • Reduce manually evidenced controls annually • Manage BAAs, security exhibits, DPAs, and the subprocessor inventory • Conduct tiered vendor security reviews and annual vendor reattestation • Maintain policies; manage security awareness, HIPAA training, phishing simulations, and completion tracking • Own the incident response program, including runbooks, tabletops, and incident coordination • Manage breach-notification timelines and contractual notification windows • Maintain a documented exception process with approver, expiry date, and compensating control • Serve as HIPAA Privacy Officer • Track state privacy laws including CCPA/CPRA and Washington My Health My Data • Establish AI governance for the AI patient billing agent, including model inventory, human oversight, and monitoring • Track emerging state rules on AI in healthcare and AI-generated patient communications • Do not own remediation engineering; DevOps owns findings and fixes • Do not own shipping decisions; document risk and escalate while the CTO sets priorities • Do not serve as a gate in design or code review

🎯 Requirements

• Extensive experience in security compliance or GRC, including time in healthcare SaaS or another PHI-handling environment • Has run SOC 2 and HITRUST as an owner, not a contributor • Deep HIPAA fluency: Security Rule, Privacy Rule, Breach Notification Rule, BAAs, minimum necessary • Hands-on with Vanta or a comparable compliance automation platform • Strong knowledge of security frameworks; ability to apply unfamiliar frameworks independently • Ability to work with NIST AI RMF and ISO 42001 • Ability to write final-draft customer-facing prose • Ability to follow technical conversations involving architecture diagrams, infrastructure-as-code, access control models, and cloud configuration • Ability to reason about threat models and assess exploitability, mitigations, applicability, and escalation needs • Software engineering or security engineering background is a strong plus, though not required • PCI DSS in a payments context is a plus • Recognized certifications include CIPP/US, HCISPP, CISSP, and HITRUST CCSFP • Ability to actively research information during the working-session exercise

🏖️ Benefits

• Unlimited PTO • Fully paid medical, dental, and vision insurance for you and your dependents • Stock options • 401(k) with a generous company match • Contributions toward student loans