Collectly

Compliance

• Own security and compliance end to end as the sole person in the function
• Build a scalable security and compliance program without adding unnecessary operational drag
• Answer customer security questionnaires
• Complete AI governance questionnaires and responsible-AI reviews for the AI patient billing agent
• Lead live security calls with prospects’ InfoSec teams
• Manage health-system procurement portals, including Archer, ProcessUnity, and Venminder
• Manage annual customer reattestation cycles
• Handle customer security escalations, incident communications, and customer-facing RCAs
• Host customers exercising right-to-audit clauses
• Distribute SOC 2, HITRUST certification, penetration-test summaries, and subprocessor notices under NDA
• Create and maintain a public trust center, standard security package, and answer library
• Own HITRUST i1 and SOC 2 Type 2 readiness, evidence, auditor management, and remediation tracking
• Own PCI DSS SAQs, collect processor AOCs, and define scope for card-present and card-not-present flows
• Conduct the annual HIPAA Security Risk Analysis and maintain the risk register
• Manage the penetration-test lifecycle, including scheduling, scoping, remediation tracking, and customer-facing summaries
• Conduct quarterly user access reviews
• Coordinate BCP/DR tabletops and annual testing
• Administer Vanta and security scanners
• Pull evidence from CI, infrastructure-as-code, identity provider, EDR, and cloud configuration systems
• Reduce manually evidenced controls annually
• Manage BAAs, security exhibits, DPAs, and the subprocessor inventory
• Conduct tiered vendor security reviews and annual vendor reattestation
• Maintain policies; manage security awareness, HIPAA training, phishing simulations, and completion tracking
• Own the incident response program, including runbooks, tabletops, and incident coordination
• Manage breach-notification timelines and contractual notification windows
• Maintain a documented exception process with approver, expiry date, and compensating control
• Serve as HIPAA Privacy Officer
• Track state privacy laws including CCPA/CPRA and Washington My Health My Data
• Establish AI governance for the AI patient billing agent, including model inventory, human oversight, and monitoring
• Track emerging state rules on AI in healthcare and AI-generated patient communications
• Do not own remediation engineering; DevOps owns findings and fixes
• Do not own shipping decisions; document risk and escalate while the CTO sets priorities
• Do not serve as a gate in design or code review

Security & Compliance Manager, GRC