Senior Security & Compliance - Healthcare Consultant | Zenara Health

Overview

Build and own Zenara Health's security and compliance program, setting risk priorities, defining HIPAA-related and technical controls, verifying they work, and leading responses to customer security reviews. This is a part-time, remote role of approximately 8–10 hours per week.

What you'll do

• Own the security and compliance roadmap, including risk prioritization, remediation tracking, and follow-through.
• Establish and maintain HIPAA-related policies, procedures, control requirements, and supporting evidence.
• Review cloud infrastructure, access controls, secrets management, and other technical safeguards with the Platform Engineer.
• Define what technical controls must achieve; partner with the Platform Engineer to implement and operate them; independently verify their effectiveness.
• Review patient-data flows, vendors, AI tools, and LLM-related data risks.
• Set requirements for how AI agents and tools access data, systems, and production environments.
• Lead responses to customer security questionnaires and coordinate preparation for audits or other external reviews.
• Establish incident response and escalation procedures, and help coordinate the response to significant security events.
• Review the Platform Engineer's security work regularly, mentor them, and identify gaps early.
• Maintain a clear record of findings, decisions, exceptions, control owners, and remediation progress.

What you'll need

• Senior-level healthcare security and compliance experience, including substantial HIPAA expertise.
• Verifiable examples of security or compliance programs, safeguards, or reviews you have led.
• Hands-on technical security knowledge across cloud infrastructure, access control, secrets, and data protection.
• Ability to assess a real technical environment, not only review policies.
• Experience establishing or improving security practices in a small or growing organization.
• Ability to translate risks and requirements into controls engineers can implement and operate.
• Experience guiding engineers while independently assessing whether their controls work.
• Clear written communication about risks, decisions, priorities, and practical next steps.
• Judgment about what to address immediately, what to plan for, and when to escalate.

Nice to have

• SOC 2 or HITRUST experience.
• Azure security experience.
• Experience building a program at an early-stage startup.
• Experience assessing AI/LLM vendors and agent access to sensitive data.

Details

• Location: Remote, India.
• Part-time, approximately 08–10 hours per week.
• Requires regular live collaboration with a US-based founder and India-based engineering team; India-evening overlap is expected, with specific hours confirmed during hiring.
• Significant security incidents may occasionally require coordination outside the usual collaboration window.
• Healthcare technology experience is preferred but not mandatory.