Senior Director, Security & Compliance at Prompt

Job description

Job Title: Senior Director, Information Security About Prompt Prompt is revolutionizing healthcare by delivering highly automated and modern software to rehab therapy businesses, their teams, and the patients they serve. As one of the fastest-growing companies in healthcare SaaS and the new standard in healthcare technology, we are committed to building a team that thrives in our fast-paced, innovative environment. As Prompt continues to scale, maintaining the trust of our customers, partners, and the patients they serve is critical. We are seeking a Senior Director, Information Security to serve as our HIPAA Security Officer and lead and mature our information security program as we continue to grow. About the Role The Senior Director, Information Security serves as the company’s designated HIPAA Security Officer and is accountable for leading and maturing the company’s information security program. This role owns the governance, control environment, certification and audit programs, security risk management, policy framework, and cross-functional operating model required to maintain compliance with HIPAA/HITECH, SOC 2, and other applicable regulatory, contractual, and certification requirements. The Senior Director will work closely with technical and business leaders to translate security requirements and risks into effective controls, clear ownership, and sustainable processes. This is a hands-on leadership role for someone who wants to build and mature the program while leveraging strong technical resources across the organization. Responsibilities • Serve as the company’s designated HIPAA Security Officer, leading the company’s information security program and partnering with Legal, Privacy, Compliance, Engineering, IT, and other stakeholders on related requirements. • Maintain sufficient technical depth to independently assess cloud architectures, application architectures, CI/CD pipelines, infrastructure-as-code, identity and access models, software supply-chain controls, and security monitoring approaches, while technical teams retain responsibility for detailed implementation and operations. • Own HIPAA Security Rule compliance, including the Security Risk Analysis, security risk-management plan, and ongoing oversight of required safeguards. • Own the company’s SOC 2 Type II program and other security certifications, attestations, and assurance programs, including control governance, audit readiness, evidence sufficiency, auditor relationships, identified deficiencies, remediation, and successful completion of audits and assessments. • Own the company’s information-security policy and control framework, including policy development, review, exceptions, ongoing governance, and alignment with applicable regulatory, contractual, and business requirements. • Establish clear ownership for security controls across the organization and ensure deficiencies, vulnerabilities, risks, and remediation plans are identified, prioritized, tracked, validated, and appropriately escalated. • Partner with Engineering, DevOps, architecture, and IT leaders to evaluate security approaches and ensure technical controls appropriately address identified requirements, while technical teams retain responsibility for detailed design and implementation. • Establish and oversee the company’s vulnerability-management and application-security programs, including expectations for vulnerability identification, penetration testing, secure software development practices, security testing, remediation, exceptions, and escalation. • Own the security incident-response framework and coordinate the company’s response to security incidents, partnering with technical teams on investigation and remediation and with Legal, Privacy, Compliance, and executive leadership on broader incident assessment and response. • Lead the security aspects of third-party risk management, enterprise customer diligence, audits, RFPs/RFIs, and security escalations. • Partner with P