{"id":870446,"url":"https://alion.io/job/clinicalnotes-security-and-compliance-manager","title":"Security and Compliance Manager","company":{"id":698450,"name":"Clinical Notes AI","domain":"clinicalnotes.ai","url":"https://alion.io/company/clinicalnotes","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Management","role_family":"Management","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Diego, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":110000,"max":165000,"currency":"USD","period":"year","gross":null,"usd_annual":165000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Google Workspace","optional":false},{"name":"HIPAA","optional":false},{"name":"SOC 2","optional":false},{"name":"GCP","optional":true},{"name":"ISO 27001","optional":true},{"name":"Okta","optional":true}],"status":"live","first_seen_at":"2026-08-10T19:23:14Z","employer_posted_date":"2026-08-10","last_verified_at":"2026-11-08T06:30:34Z","board_verified":true,"closed_at":null,"days_open":89,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":89},"description":"About Clinically AI\nClinically AI is a rapidly scaling healthcare AI company transforming how behavioral health and healthcare organizations manage clinical documentation, compliance workflows, chart auditing, and operational efficiency through artificial intelligence.\nOur platform helps clinicians, compliance teams, administrators, and healthcare organizations reduce administrative burden, improve documentation quality, strengthen audit readiness, and operate more efficiently. We operate at the intersection of AI, healthcare operations, workflow design, and real-world clinical execution, where adoption, trust, usability, and measurable outcomes matter.\nThe Opportunity\nWe are seeking a Security and Compliance Manager to own the day-to-day operation of our compliance program end to end, keeping our frameworks audit-ready, our policies current, and our workforce systems locked down.\nThis is a critical role for someone who can manage our compliance platform of record, drive remediation on failing controls to closure, and administer the workforce security layer (Google Workspace and MDM) that our compliance posture depends on. You will work closely with engineering, product, and executive leadership to keep the company continuously compliant as we scale at high velocity.\nThis is not a purely administrative, ticket-routing role. You should be comfortable owning remediation from detection to closure, operating with high rigor, and driving issues to resolution yourself rather than just flagging them, in a fast-moving startup environment.\nWe believe a successful compliance function is defined not by simply passing audits, but by continuous audit-readiness, strong workforce security hygiene, and trust earned with enterprise customers.\nWhat You'll Own\nOwn our compliance platform of record - manage frameworks (SOC2 Type II, HIPAA, NIST, etc.), controls, tests, policies, and integrations.\n\nMonitor compliance tests continuously; triage failures, remediate directly where possible, and drive owners to resolution where not.\n\nMaintain and update security policies, procedures, and system documentation, ensuring they reflect actual practice and are reviewed/acknowledged on schedule.\n\nManage evidence collection and audit readiness, keeping automated evidence flowing and closing gaps in manual evidence before auditors ask.\n\nCoordinate external audits (SOC2 Type II, HIPAA, NIST, ISO, etc.) end to end - auditor communication, evidence requests, findings, and remediation plans.\n\nAdminister Google Workspace, including user lifecycle management, access controls, 2FA/SSO enforcement, and audit log reviews.\n\nManage our MDM to ensure all endpoints are enrolled, encrypted, patched, and compliant with policy.\n\nTrack risk via risk assessments and the risk register, and lead mitigation planning with stakeholders.\n\nWhat We're Looking For\nCompliance Ownership: You treat a failing compliance test as a to-do item, not a ticket to route elsewhere - you drive remediation from detection to closure yourself.\n\nOperational Rigor: You maintain accurate, up-to-date policies and documentation, and keep evidence collection running continuously rather than scrambling before an audit.\n\nSecurity & IT Administration Fluency: You're comfortable administering Google Workspace and MDM tooling directly - user lifecycle, access reviews, and endpoint compliance are second nature to you.\n\nCross-Functional Collaboration: You partner effectively with engineering, product, and leadership, scoping remediation work and reporting compliance posture clearly to non-technical stakeholders.\n\nHigh Ownership Mindset: You operate with follow-through in a high-velocity, fast-scaling environment, without needing heavy oversight.\n\nRequired Qualifications\n3+ years of experience in security compliance, GRC, IT security administration, or similar roles.\n\nHands-on experience administering a compliance automation platform (e.g., Vanta, Drata, or Secureframe), including frameworks, tests, policies, and remediation workflows.\n\nDirect experience with SOC2 Type II and/or HIPAA compliance programs - evidence collection, audits, and continuous control operations.\n\nExperience administering Google Workspace in a business environment (user lifecycle, security settings, access controls).\n\nExperience managing an MDM solution (e.g., Kandji, Jamf, Mosyle, or similar) for endpoint compliance.\n\nAbility to write, maintain, and operationalize security policies and compliance documentation.\n\nStrong organizational and follow-through skills - comfortable owning remediation from detection to closure.\n\nPreferred Qualifications\nExperience in healthcare, healthtech, or another regulated data environment.\n\nFamiliarity with additional frameworks (HITRUST, ISO27001, NIST) and experience adding new frameworks to a compliance platform.\n\nExperience supporting enterprise customer security reviews, RFPs, and partner compliance requirements.\n\nWorking knowledge of cloud environments (GCP preferred) sufficient to coordinate remediation with engineering teams.\n\nExperience with identity and access tooling (SSO/SAML, Google Cloud Identity, Okta, or similar).\n\nCertifications such as CISA, CISM, Security+, CCSK, or equivalent practical experience.\n\nCompensation & Benefits\nBase salary: $110,000-$165,000 + equity\nActual compensation will depend on experience, scope, and overall alignment with the role.\nWe offer competitive compensation, equity participation, healthcare coverage (medical, dental, vision), unlimited PTO, and a 401(k) with company match plus Roth option.\nEqual Employment Opportunity\nClinically AI provides equal employment opportunities to all employees and applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetics, or any other characteristic protected by applicable law.","description_format":"text","description_chars":5852,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Unlimited PTO"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Medical AI","EHR & Clinical Software"],"lifecycle":[{"event":"open","at":"2026-09-13T16:41:27Z"}],"visa":[],"liveness":{"score":14,"band":"cold","label":"Long shot","p_open":1,"p_active":0.498,"p_room":0.28,"age_days":89,"expected_fill_days":30,"reasons":["conf:3","win:tail","crowd:"],"computed_at":"2026-11-08T05:47:12Z"},"pay":{"stated_usd_annual":165000,"is_top_pay":true},"html_url":"https://alion.io/job/clinicalnotes-security-and-compliance-manager","json_url":"https://alion.io/job/clinicalnotes-security-and-compliance-manager.json","meta":{"generated_at":"2026-11-08T10:31:34Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":22692,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":698450},"rest":"https://alion.io/mcp/rest/get_company?id=698450"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fclinicalnotes-security-and-compliance-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fclinicalnotes-security-and-compliance-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fclinicalnotes-security-and-compliance-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/clinicalnotes-security-and-compliance-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fclinicalnotes-security-and-compliance-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":870446}},{"tool":"search_jobs","arguments":{"company":"clinicalnotes.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":870446},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}