Senior Security & Compliance - Healthcare | Zenara Health

About this role

Location: Remote - India
Type: Full-time
Working Hours: All meetings and live collaboration happen between approximately 6:00 PM and 12:00 AM IST, overlapping US Pacific Time. Attendance in that window is required. Your remaining work is yours to schedule.
Commitment: Approximately 50 hours per week
Industry: Healthcare technology experience is preferred but not mandatory
About the Company
Zenara Health is a technology-oriented mental healthcare organization building clinical software for behavioral-health clinics. We work with sensitive patient data, so security, access control, vendor risk, AI-tool risk, and evidence of how our controls operate are fundamental to earning customer trust.
We are a startup, not a department. We move quickly and need a security and compliance program that is rigorous enough for healthcare and practical enough to work in a small, fast-moving company.
About the Role
We are looking for a Senior Security & Compliance Lead to build and own Zenara’s security and compliance program.
You will set risk priorities, define security and HIPAA-related controls, verify that they work, and lead our responses to customer security reviews. You will work closely with the Head of Engineering and our Platform Engineer, who owns day-to-day platform operations and implements and operates many of the technical controls.
You own the program’s direction and outcomes. The Platform Engineer owns the day-to-day operation of the platform. You will work together to turn security requirements into working practices, not just documents.
Here is the test: can you inspect a real technical environment, identify the risks that matter most, explain the trade-offs, and work with engineers to implement and verify effective controls?
We are not looking for someone who only produces compliance paperwork. We need a leader with healthcare security judgment, technical depth, and the willingness to remain involved until a control actually works.
Our Security and Compliance Vision
Security and compliance should be part of how Zenara operates every day—not a last-minute exercise when a customer sends a questionnaire.
You will build a program with clear control owners, practical policies, current evidence, tracked remediation, and tested response procedures. It should give engineering a safe path to move quickly while helping us protect patient data and answer customer questions with confidence.
Your remit includes:

• HIPAA-related safeguards, policies, and evidence

• Security risk assessment and remediation priorities

• Technical control standards and verification

• Patient-data flows and access controls

• Vendor and AI-tool risk

• Customer security reviews and audit preparation

• Incident response and escalation procedures

• Security practices for AI-assisted engineering

The goal is not to create the largest possible program. It is to establish the right controls, make ownership clear, and ensure those controls keep working as Zenara grows.
What You’ll Do

• Own the security and compliance roadmap, including risk prioritization, remediation tracking, and follow-through.

• Establish and maintain HIPAA-related policies, procedures, control requirements, and supporting evidence.

• Review cloud infrastructure, access controls, secrets management, and other technical safeguards with the Platform Engineer.

• Define what technical controls must achieve; partner with the Platform Engineer to implement and operate them; independently verify their effectiveness.

• Review patient-data flows, vendors, AI tools, and LLM-related data risks.

• Set requirements for how AI agents and tools access data, systems, and production environments.

• Lead responses to customer security questionnaires and coordinate preparation for audits or other external reviews.

• Establish incident response and escalation procedures, and help coordinate the response to significant security events.

• Review the Platform Engineer’s security work regularly, mentor them, and identify gaps early.

• Maintain a clear record of findings, decisions, exceptions, control owners, and remediation progress.

How You’ll Work With the Platform Engineer
These are closely connected roles, but they do not have identical ownership.
You will own: security and compliance strategy, risk decisions, control standards, HIPAA-related program requirements, verification, vendor and AI-tool risk reviews, and customer security responses.
The Platform Engineer will own: day-to-day infrastructure operations, deployments, monitoring, backups and restores, technical implementation of platform controls, and recurring operational checks.
For example, you may define the access-control standard and how its effectiveness will be verified. The Platform Engineer may implement it in Azure and operate the recurring checks. You will review the evidence, address exceptions, and remain accountable for whether the standard is adequate.
What AI-Native Security Means Here
Our engineering team uses AI agents to help build and operate software. That creates opportunities to improve speed and consistency, as well as risks that conventional security processes may miss.
You will help define:

• Which tools and agents may access patient data, code, infrastructure, and production systems

• What permissions and approval boundaries they need

• How we assess AI vendors and data-processing risks

• How agent activity and security findings are logged, reviewed, and escalated

• Where automation can improve control monitoring and evidence collection

You do not need to be the person building every agent. You do need the judgment to govern their use and verify that automated checks are reliable. AI can assist with security work; it does not take accountability for security decisions.
What We’re Looking For

• Senior-level healthcare security and compliance experience, including substantial HIPAA expertise.

• Verifiable examples of security or compliance programs, safeguards, or…