Compliance and Security Director - Bluesight

About the Role

Bluesight is seeking a Director of Compliance and Risk to join our Legal team, reporting to the General Counsel. You will own our compliance posture (SOC 2, HIPAA), risk program, and customer-facing regulatory assurance. You will partner with the CTO/Security Officer and the Security Engineering team to improve our security and compliance landscape, including charting the path for AI in healthcare software.

What You'll Do

• Compliance Leadership: Act as the hands-on driver for our SOC2 compliance program, managing annual audits and certifications.
• Risk Management: Own the Bluesight risk register, annual risk assessments, third-party/vendor risk, BCP/DR, and policy lifecycles.
• Customer Assurance: Engage directly with hospital customers to complete complex security/IT questionnaires and address contract issues regarding compliance.
• Technical Oversight: Assess and document compliance controls across AWS (configurations, access controls, logging, encryption) and partner with IT on endpoint protection and IAM.
• Strategy: Shape our forward-looking compliance strategy, specifically navigating the intersection of healthcare data security and AI.
• Internal Enablement: Conduct internal audits, train employees, and advise on security best practices across the organization.

Qualifications

• Experience developing and monitoring internal practices for SOC2, HIPAA, NIST, or ISO compliance standards.
• Familiarity with hospital security operations and the ability to represent security posture to customers.
• Working knowledge of cloud infrastructure (AWS preferred) and the shared responsibility model.
• Working knowledge of AI governance (NIST AI RMF) and interest in AI regulation.
• Strong familiarity with GRC platforms (e.g., Vanta, Drata).
• Ability to communicate complex information to a broad audience and drive work to completion in ambiguous environments.

Benefits

• Competitive salary
• Unlimited vacation days
• Generous insurance coverage
• 401k program with company match
• Annual discretionary bonus eligibility