About IntusCare: IntusCare is the only end-to-end technology ecosystem built specifically for PACE (Programs of All-Inclusive Care for the Elderly) and similar coordinated care models. We help our customers deliver exceptional care, strengthen financial performance, and stay compliant through a purpose-built EMR and a suite of modern, cloud-native solutions where data and AI sit at the center of everything we do. The result: modern infrastructure for complex senior care, so teams spend less time wrestling with systems and more time caring for older adults with the dignity they deserve. Role Overview: Intus Care is seeking a hands-on Manager, Security & Compliance to lead our security program and the compliance work that depends on it. This is a technical role: you will configure, operate, and tune our security tooling yourself, own security incident response, and lead our HIPAA, SOC 2, and HITRUST programs while partnering closely with Engineering, Product, SRE, IT, Legal, and customer-facing teams. We are looking for a security practitioner who has personally administered endpoint, identity, and monitoring controls, knows healthcare compliance, and is comfortable both fixing a control and proving it works in a growing healthcare SaaS organization. The right candidate can translate regulatory and security requirements into working controls, processes, and measurable outcomes. Key Responsibilities: • Implement, configure, and operate core security controls yourself: endpoint detection and response (e.g., CrowdStrike Falcon, Microsoft Defender), identity and privileged access (e.g., Entra ID conditional access, MFA, PIM), logging and monitoring, vulnerability management, and encryption. • Mature our detection and monitoring capabilities, including centralized logging, alerting, and SIEM, and tune them so alerts lead to action. • Triage vulnerability, cloud-posture, and penetration-test findings yourself, verify fixes, and drive remediation against defined SLAs. • Secure our Azure and Kubernetes (AKS) environments with the Platform and SRE teams, and automate security checks and compliance evidence through scripting (e.g., PowerShell, Python, KQL). • Own and continuously improve IntusCare's security and compliance programs across HIPAA, SOC 2, HITRUST, and applicable privacy requirements. • Lead IntusCare's HITRUST certification, other audits, and risk assessments end to end, including scoping, readiness assessment, evidence collection, assessor coordination, and corrective action plans, moving evidence from point-in-time collection toward continuous, system-generated compliance. • Manage IntusCare's external security and compliance partners, including the advisory firm supporting audit preparation, HITRUST assessors, and penetration testers. Direct their scope and priorities, hold them accountable to deliverables, ensure their findings translate into owned remediation, and keep advisory and assessment roles independent. • Partner with Engineering, Product, the Platform team, SRE, and IT to integrate security into architecture, infrastructure, product development, and the SDLC, including security and PHI-handling standards and guardrails for AI-assisted development. • Lead security incident responses, including hands-on investigation, containment, communication, post-incident reviews, and corrective actions, as part of Intus Care's unified incident management process across SRE, Security, and IT. • Maintain security policies, procedures, Business Associate Agreements (BAAs), data handling requirements, and breach response plans, and serve as the day-to-day lead for HIPAA Security Rule obligations, supporting Intus Care's designated HIPAA Security Official and partnering with the Privacy Officer. • Support customer security reviews, due diligence, onboarding, and security/privacy requirements during contract negotiations. • Establish security and compliance metrics, maintain the security roadmap with clear owners for every risk and finding, and provide leadership with visibility into risks, incidents, vulnerabilities, remediation progress, and audit readiness. • Lead security awareness and compliance training, and manage, develop, and mentor the security and compliance team. Requirements: • 7+ years of experience in information security, including 3+ years in hands-on security engineering, operations, or administration, preferably within healthcare SaaS or health technology. • Hands-on experience administering security tooling yourself, not only overseeing it: endpoint detection and response (e.g., CrowdStrike, Microsoft Defender), SIEM or log analytics, identity provider controls (conditional access, MFA, privileged access management), and vulnerability scanning. • Hands-on experience securing at least one major cloud platform (Azure preferred), and the ability to script or automate security tasks (e.g., PowerShell, Python, KQL). • Working knowledge of HIPAA, SOC 2, HITRUST, healthcare privacy requirements, and security control frameworks. • Experience owning, or leading a major workstream of, an external certification or attestation (SOC 2 Type II, HITRUST, or ISO 27001), including directing external advisors and assessors. • Hands-on incident response experience, including investigating alerts, containing threats, and running post-incident reviews. • Experience partnering with Engineering and Product teams to incorporate security into technology and development processes. • Experience with vendor risk management and third-party security assessments. • Strong communication skills with the ability to translate security and regulatory requirements for technical and non-technical audiences. • Experience working with healthcare technology, EMRs, clinical systems, or healthcare data environments. Preferred Qualifications: • HITRUST certification experience (e1, i1, or r2), ideally as the accountable owner. • Experience implementing or tuning a SIEM (e.g., Microsoft Sentinel or a comparable plat