Compliance and Security Director
Bluesight
Compliance and Security Director
Bluesight
RFID-based medication management for hospitals
Salary Range: 155000 to 170000 (Currency: USD) (Pay period: per-year-salary)
What You'll Do: Bluesight is hiring a Director, Compliance and Risk to join our Legal team, reporting to the General Counsel. You will own our compliance posture (SOC 2, HIPAA), risk program, and customer-facing regulatory assurance. You will partner with the CTO/Security Officer and the Security Engineering team, which owns product security (AppSec, vuln mgmt, pen test, IR) and IT (endpoint, IAM). You will be responsible for owning, operating, and improving all aspects of our compliance and requirements for SOC2 and HIPAA.
As our compliance landscape evolves alongside new technologies, we need someone deeply interested in charting the path forward for compliance and AI in healthcare software.
In this role, you can expect to:
Act as the hands-on driver leading our SOC2 compliance program and managing the annual audit and certification process.
Own the Bluesight risk register, annual risk assessment, third-party/vendor risk, BCP/DR, and policy lifecycles.
Engage in direct conversations with potential and current hospital customers regarding completing complex security and IT questions and concerns.
Own the customer security review process: complete complex security and IT questionnaires from hospital customers and respond to technical questions and contract issues on compliance and security.
Assess and document compliance controls across our cloud infrastructure (AWS), working with Engineering to validate configurations, access controls, logging, encryption, and shared responsibility boundaries for SOC 2 and HIPAA evidence.
Partner with IT on endpoint protection, IAM, and access reviews, and own the audit evidence for them.
Set up and extend our compliance automation platform.
Conduct internal audits, train employees, and advise on security and compliance across Bluesight.
Help shape and socialize our forward-looking compliance strategy, specifically navigating the intersection of healthcare data security and AI.
Document your work and decision-making processes, and lead presentations and discussions with a broad audience
Uphold a culture of collaboration, transparency, creativity, inclusion, and data-driven decisions.
Experience developing, implementing, and monitoring internal practices for SOC2, HIPAA, NIST, or ISO compliance standards.
Familiarity with hospital security operations and the ability to accurately and credibly represent Bluesight's security posture and the maturity of our operations to customers.
Working knowledge of cloud infrastructure and security (AWS preferred): IAM, networks, encryption and key management, logging/monitoring, and the shared responsibility model. You can read an architecture diagram and challenge a control claim.
Working knowledge of AI governance ( NIST AI RMF or vendor AI risk) and a proactive interest in AI regulation.
Clear communication of complex and critical information to a broad audience.
Subject matter expertise in security best practices. and the ability to recommend risk treatment and escalate items for acceptance.
A drive to learn unfamiliar domains and a willingness to work across departments as the product and data requirements evolve
Autonomy and proactivity around driving work to completion in the face of ambiguity and across multiple stakeholders.
Strong familiarity with data, data protection and privacy, and with compliance automation or GRC platforms (Vanta, Drata etc.)
Opportunities to solve problems of scale across a tech-forward, fast-growing company
Strong voice in what we work on, how it works, and how it is built
Room to be creative and choose your own path
Trust in your sense of ownership
Coworkers who you'll learn from, who will push you and who are looking to learn from you
Bluesight builds medication management software for hospitals that uses RFID to track medications and supply carts in real time. Its core products, KitCheck and CostCheck, help hospitals manage inventory, optimize drug purchasing, and reduce waste by ensuring accurate restocking in crash carts, operating rooms, and other areas. The system works by attaching RFID tags to medications and trays, giving pharmacists and nurses item-level visibility and real-time data through an integrated workflow that simplifies stocking and provides actionable analytics. Bluesight differentiates itself by combining RFID-enabled, precise inventory control with cost optimization and waste reduction tailored to hospital workflows, aiming to cut costs, minimize risks, and improve patient safety. The company’s goal is to help healthcare providers lower medication-related expenses and inefficiencies while ensuring timely, accurate availability of drugs.
Explore more opportunities at Bluesight