Manager of Security and Compliance

About IntusCare: IntusCare is the only end-to-end technology ecosystem built specifically for PACE (Programs of All-Inclusive Care for the Elderly) and similar coordinated care models. We help our customers deliver exceptional care, strengthen financial performance, and stay compliant through a purpose-built EMR and a suite of modern, cloud-native solutions where data and AI sit at the center of everything we do. The result: modern infrastructure for complex senior care, so teams spend less time wrestling with systems and more time caring for older adults with the dignity they deserve.

Role Overview:

Intus Care is seeking a hands-on Manager, Security & Compliance to lead our security program and the compliance work that depends on it. This is a technical role: you will configure, operate, and tune our security tooling yourself, own security incident response, and lead our HIPAA, SOC 2, and HITRUST programs while partnering closely with Engineering, Product, SRE, IT, Legal, and customer-facing teams. We are looking for a security practitioner who has personally administered endpoint, identity, and monitoring controls, knows healthcare compliance, and is comfortable both fixing a control and proving it works in a growing healthcare SaaS organization. The right candidate can translate regulatory and security requirements into working controls, processes, and measurable outcomes.

Key Responsibilities:

• Implement, configure, and operate core security controls yourself: endpoint detection and response (e.g., CrowdStrike Falcon, Microsoft Defender), identity and privileged access (e.g., Entra ID conditional access, MFA, PIM), logging and monitoring, vulnerability management, and encryption.

• Mature our detection and monitoring capabilities, including centralized logging, alerting, and SIEM, and tune them so alerts lead to action.

• Triage vulnerability, cloud-posture, and penetration-test findings yourself, verify fixes, and drive remediation against defined SLAs.

• Secure our Azure and Kubernetes (AKS) environments with the Platform and SRE teams, and automate security checks and compliance evidence through scripting (e.g., PowerShell, Python, KQL).

• Own and continuously improve IntusCare's security and compliance programs across HIPAA, SOC 2, HITRUST, and applicable privacy requirements.

• Lead IntusCare's HITRUST certification, other audits, and risk assessments end to end, including scoping, readiness assessment, evidence collection, assessor coordination, and corrective action plans, moving evidence from point-in-time collection toward continuous, system-generated compliance.

• Manage IntusCare's external security and compliance partners, including the advisory firm supporting audit preparation, HITRUST assessors, and penetration testers. Direct their scope and priorities, hold them accountable to deliverables, ensure their findings translate into owned remediation, and keep advisory and assessment roles independent.

• Partner with Engineering, Product, the Platform team, SRE, and IT to integrate security into architecture, infrastructure, product development, and the SDLC, including security and PHI-handling standards and guardrails for AI-assisted development.

• Lead security incident responses, including hands-on investigation, containment, communication, post-incident reviews, and corrective actions, as part of Intus Care's unified incident management process across SRE, Security, and IT.

• Maintain security policies, procedures, Business Associate Agreements (BAAs), data handling requirements, and breach response plans, and serve as the day-to-day lead for HIPAA Security Rule obligations, supporting Intus Care's designated HIPAA Security Official and partnering with the Privacy Officer.

• Support customer security reviews, due diligence, onboarding, and security/privacy requirements during contract negotiations.

• Establish security and compliance metrics, maintain the security roadmap with clear owners for every risk and finding, and provide leadership with visibility into risks, incidents, vulnerabilities, remediation progress, and audit readiness.

• Lead security awareness and compliance training, and manage, develop, and mentor the security and compliance team.

Requirements:

• 7+ years of experience in information security, including 3+ years in hands-on security engineering, operations, or administration, preferably within healthcare SaaS or health technology.

• Hands-on experience administering security tooling yourself, not only overseeing it: endpoint detection and response (e.g., CrowdStrike, Microsoft Defender), SIEM or log analytics, identity provider controls (conditional access, MFA, privileged access management), and vulnerability scanning.

• Hands-on experience securing at least one major cloud platform (Azure preferred), and the ability to script or automate security tasks (e.g., PowerShell, Python, KQL).

• Working knowledge of HIPAA, SOC 2, HITRUST, healthcare privacy requirements, and security control frameworks.

• Experience owning, or leading a major workstream of, an external certification or attestation (SOC 2 Type II, HITRUST, or ISO 27001), including directing external advisors and assessors.

• Hands-on incident response experience, including investigating alerts, containing threats, and running post-incident reviews.

• Experience partnering with Engineering and Product teams to incorporate security into technology and development processes.

• Experience with vendor risk management and third-party security assessments.

• Strong communication skills with the ability to translate security and regulatory requirements for technical and non-technical audiences.

• Experience working with healthcare technology, EMRs, clinical systems, or healthcare data environments.

Preferred Qualifications:

• HITRUST certification experience (e1, i1, or r2), ideally as the accountable owner.

• Experience implementing or tuning a SIEM (e.g., Microsoft Sentinel or a comparable platform).

• Experience with PACE, value-based care, Medicare/Medicaid, or regulated healthcare environments.

• Experience as the first or sole security hire, or building or scaling security and compliance programs in a growing SaaS company.

• Experience securing cloud-native environments (Azure and Kubernetes/AKS preferred), including DevSecOps and security automation.

• Experience leading a small security/compliance team or cross-functional security initiatives.

• Relevant certifications such as AZ-500, SC-200, GIAC, CCSFP, CISSP, CISM, or HCISPP.

What Success Looks Like:

The Manager, Security & Compliance will help build a security and compliance function that is proactive, measurable, audit-ready, and integrated into how IntusCare builds and operates its products. In the first year, success includes owning and tuning our security tooling so detections lead to action, maturing centralized logging and monitoring, achieving and maintaining HITRUST certification with findings remediated, and running security incidents consistently through the unified incident process. Success in this role means maintaining strong audit and regulatory readiness, proactively identifying and reducing risk, driving vulnerabilities and findings through remediation, improving security visibility across the organization, and establishing security as a trusted partner to Engineering, Product, customers, and the business. Ultimately, this role will help ensure IntusCare can continue to innovate and scale while protecting sensitive healthcare information and maintaining the trust of our customers and the participants they serve.

Compensation:

The base salary range for this role is 130K-150K. We expect the ideal candidate to fall near the midpoint of this range, though final compensation will be determined based on experience, skills, and organizational needs.

Work location: This is a fully remote role based in the United States.

Sponsorship: This position is not eligible for sponsorship.