Head of Security & Compliance

Why this role

Security and compliance are core to Knit Health's ability to earn the trust of health systems, partners, and patients. We’re bringing on our first enterprise customers, starting with pilots. We've relied on an outsourced virtual CISO, alongside our operations, engineering, and IT teams, to build the foundation.  It's now time to bring that leadership in-house.

We’re looking for a hands-on security leader who sets the security vision and roadmap, represents Knit credibly to customers, auditors, and health-system security reviewers, and personally does the early-stage work of building the program: writing policies, gathering audit evidence, configuring and writing tools, and closing gaps. You’ll lead a cross-functional team spanning operations, engineering, IT, and external partners. These team members don’t report to you directly, but you’ll own the security outcomes they deliver. As the company grows, you’ll have the opportunity to build out a dedicated security team. 

This is a rare opportunity to build a security function from the ground up at a fast-moving, venture-backed healthcare AI company, with real influence over how Knit scales its security and compliance posture and what it means for clinical AI to be trustworthy.

What you’ll do 

Security Leadership & Vision

• Own Knit's overall security strategy and roadmap, setting priorities that match our stage, risk profile, and growth plans as a healthcare AI company handling sensitive clinical data.
• Serve as Knit's security executive to customers, prospects, auditors, and partners, credibly answering security questionnaires, leading security reviews, and representing the program in sales and diligence conversations.
• Build a security-aware engineering culture: clear guidance on what data can go where, training on secure coding, and fast, lightweight consults so engineers know when to stop and ask. 
• Advise leadership, investors, and the board on security risk, incident response readiness, and compliance posture in plain, business-relevant terms.

Compliance & Audit Readiness

• Take ownership of our compliance programs, building on our completed SOC 2 Type 1 and first Type II audit period, and lead the next stage of HIPAA compliance as we move more workloads into our own environment. 
• Gather, organize, and validate audit evidence, run control testing, and manage the mechanics of certification and renewal cycles.
• Build and maintain the policies, procedures, and documentation that our controls rely on, and keep them current as the company evolves.
• Lead the evaluation of whether and when Knit should pursue HITRUST certification.

Program & Infrastructure Build-Out

• Design and implement the practical building blocks of a security program at an early-stage company: access management, vendor risk reviews, endpoint and cloud security configuration, logging and monitoring, and incident response plans.
• Audit and validate our cloud, development systems, SaaS tools, and data pipelines; our platform engineers and IT/SecOps partners build and operate the systems; you verify it and drive fixes, rolling up your sleeves alongside them rather than only directing.
• Own the security and compliance budget, including tooling (e.g., GRC platforms, vulnerability scanning), vendors, training, and contracted audit support, choosing what fits a lean, high-growth team.
• Own the incident response program: keep the plan current and effective, train incident commanders, and lead response from detection and triage through resolution and any required customer or regulatory notification.

Data Protection & Risk Management

• Ensure appropriate safeguards are in place for handling clinical, PHI, and other sensitive data, including with respect to our AI/ML products, AI-assisted development workflows, and data pipelines.
• Run ongoing risk assessments and vendor security reviews, and manage third-party risk as Knit's partner and data-provider relationships grow.

Minimum qualifications

• Prior experience as a senior security leader at a healthcare technology or health data company of roughly 50 - 1,000 people, owning a program with real external demands: enterprise customers, third-party audits, and regulatory requirements.
• Direct ownership of a HIPAA program and a SOC 2 Type II (or comparable, such as HITRUST or ISO 27001) audit, including personally doing evidence, policy, questionnaire, and contract review work, not only overseeing it.
• Strong working knowledge of cloud security (AWS, Azure, or GCP), identity and access management, and common SaaS security tooling, including the ability to directly review code and infrastructure.
• Experience representing security to external audiences (customers, auditors, or partners) including completing security questionnaires and leading review calls.
• Excellent written and verbal communication skills, with the ability to translate technical risk into terms a non-technical audience (leadership, customers, sales) can act on.
• Comfortable operating with significant autonomy in a fast-moving, resource-constrained startup environment. You’re comfortable building directly and energized by being a team of one.
• Track record of driving security outcomes through cross-functional teams you don’t directly manage, including engineering and IT, and resolving competing priorities through planning and collaboration.

Nice-to-haves

• Experience securing AI/ML systems, LLM-based products, or data pipelines feeding machine learning models.
• Knowledge of Python, SQL, and Terraform.
• A relevant security certification (e.g., CISSP, CISM, or similar), though we care more about demonstrated hands-on experience than credentials.
• Prior experience transitioning a company from an outsourced or fractional security function to an in-house program.

Salary Range

Knit Health offers a competitive compensation package that includes base salary, equity, and opportunities for advancement. The starting salary range is approximately $200,000 to $265,000 per year.