Sully.ai

Security & Compliance Manager, Healthcare

Sully.ai

full-time

Posted on:

Origin:  • 🇺🇸 United States

Visit company website
✨ AI Apply
Manual Apply

Job Level

Mid-LevelSenior

Tech Stack

AWSAzureCloudGoogle Cloud PlatformPythonSQLTerraform

About the role

  • Sully.ai is building the future of AI healthcare employees—scribes, coders, assistants—that help clinicians work faster and safer, integrated with leading EHRs.\n
  • Mission is “One Human, One Doctor,” and security is foundational to delivering on that promise.\n
  • We're hiring our first Security & Compliance Manager to own: control ownership across frameworks; maintaining audit-grade compliance; security prioritization challenges.\n
  • What you’ll do: Own our controls across SOC 2 Type II, ISO 27001, and HIPAA; run identity & access lifecycle; triage security engineering work; prep/host audits; handle customer trust work; coordinate monitoring runbooks; champion security-by-default in AI pipelines; own vendor relationships.\n
  • What success looks like (OKRs): control health, audit readiness, access hygiene, backlog throughput, customer trust, incident prep.\n
  • What you bring: 5+ years in Security GRC / SecOps / IT; HIPAA/HITECH; multi-cloud IAM; experience with Delve and CSPM/EDR; strong PM; scripting and SQL.\n
  • Nice to have: HITRUST, ISO 27001 Lead Implementer/Lead Auditor, CCSK/CISSP.\n
  • Why Join Sully.ai: Shape the Future of Healthcare; Early-Stage Impact; Remote-First Culture; Competitive Compensation; Solve Scalability Challenges.

Requirements

  • 5+ years in Security GRC / SecOps / IT with healthcare exposure; hands-on with SOC 2 & ISO 27001 (evidence, CAPs).\n
  • Working knowledge of HIPAA/HITECH, BAAs, and PHI data flows; HITRUST familiarity is a plus.\n
  • Multi-cloud IAM (AWS/GCP/Azure), SSO/SCIM, RBAC, just-in-time access; can read Terraform/IaC and basic logs.\n
  • Experience with compliance automation and device/identity platforms (e.g., Delve; Electric.ai), ticketing (Linear/Jira), and CSPM/EDR.\n
  • Strong program/project management; able to lead cross-functional work without formal authority; crisp customer-facing communicator.\n
  • Light scripting (Python/Bash) to automate evidence pulls or access reviews; SQL basics for data-access checks.