Location: Remote - India
Type: Part-time
Commitment: Approximately 08-10 hours per week
Industry: Healthcare technology experience is preferred but not mandatory
About the Company
Zenara Health is a technology-oriented mental healthcare organization building clinical software for behavioral-health clinics. We work with sensitive patient data, so security, access control, vendor risk, AI-tool risk, and evidence of how our controls operate are fundamental to earning customer trust.
We are a startup, not a department. We move quickly and need a security and compliance program that is rigorous enough for healthcare and practical enough to work in a small, fast-moving company.
About the Role
We are looking for a Senior Security & Compliance Lead to build and own Zenara’s security and compliance program.
You will set risk priorities, define security and HIPAA-related controls, verify that they work, and lead our responses to customer security reviews. You will work closely with the Head of Engineering and our Platform Engineer, who owns day-to-day platform operations and implements and operates many of the technical controls.
You own the program’s direction and outcomes. The Platform Engineer owns the day-to-day operation of the platform. You will work together to turn security requirements into working practices, not just documents.
Here is the test: can you inspect a real technical environment, identify the risks that matter most, explain the trade-offs, and work with engineers to implement and verify effective controls?
We are not looking for someone who only produces compliance paperwork. We need a leader with healthcare security judgment, technical depth, and the willingness to remain involved until a control actually works.
Our Security and Compliance Vision
Security and compliance should be part of how Zenara operates every day—not a last-minute exercise when a customer sends a questionnaire.
You will build a program with clear control owners, practical policies, current evidence, tracked remediation, and tested response procedures. It should give engineering a safe path to move quickly while helping us protect patient data and answer customer questions with confidence.
Your remit includes:
• HIPAA-related safeguards, policies, and evidence
• Security risk assessment and remediation priorities
• Technical control standards and verification
• Patient-data flows and access controls
• Vendor and AI-tool risk
• Customer security reviews and audit preparation
• Incident response and escalation procedures
• Security practices for AI-assisted engineering
The goal is not to create the largest possible program. It is to establish the right controls, make ownership clear, and ensure those controls keep working as Zenara grows.
What You’ll Do
• Own the security and compliance roadmap, including risk prioritization, remediation tracking, and follow-through.
• Establish and maintain HIPAA-related policies, procedures, control requirements, and supporting evidence.
• Review cloud infrastructure, access controls, secrets management, and other technical safeguards with the Platform Engineer.
• Define what technical controls must achieve; partner with the Platform Engineer to implement and operate them; independently verify their effectiveness.
• Review patient-data flows, vendors, AI tools, and LLM-related data risks.
• Set requirements for how AI agents and tools access data, systems, and production environments.
• Lead responses to customer security questionnaires and coordinate preparation for audits or other external reviews.
• Establish incident response and escalation procedures, and help coordinate the response to significant security events.
• Review the Platform Engineer’s security work regularly, mentor them, and identify gaps early.
• Maintain a clear record of findings, decisions, exceptions, control owners, and remediation progress.
How You’ll Work With the Platform Engineer
These are closely connected roles, but they do not have identical ownership.
You will own: security and compliance strategy, risk decisions, control standards, HIPAA-related program requirements, verification, vendor and AI-tool risk reviews, and customer security responses.
The Platform Engineer will own: day-to-day infrastructure operations, deployments, monitoring, backups and restores, technical implementation of platform controls, and recurring operational checks.
For example, you may define the access-control standard and how its effectiveness will be verified. The Platform Engineer may implement it in Azure and operate the recurring checks. You will review the evidence, address exceptions, and remain accountable for whether the standard is adequate.
What AI-Native Security Means Here
Our engineering team uses AI agents to help build and operate software. That creates opportunities to improve speed and consistency, as well as risks that conventional security processes may miss.
You will help define:
• Which tools and agents may access patient data, code, infrastructure, and production systems
• What permissions and approval boundaries they need
• How we assess AI vendors and data-processing risks
• How agent activity and security findings are logged, reviewed, and escalated
• Where automation can improve control monitoring and evidence collection
You do not need to be the person building every agent. You do need the judgment to govern their use and verify that automated checks are reliable. AI can assist with security work; it does not take accountability for security decisions.
What We’re Looking For
• Senior-level healthcare security and compliance experience, including substantial HIPAA expertise.
• Verifiable examples of security or compliance programs, safeguards, or reviews you have led.
• Hands-on technical security knowledge across cloud infrastructure, access control, secrets, and data protection.
• Ability to assess a real technical environment—not only review policies.
• Experience establishing or improving security practices in a small or growing organization.
• Ability to translate risks and requirements into controls engineers can implement and operate.
• Experience guiding engineers while independently assessing whether their controls work.
• Clear written communication about risks, decisions, priorities, and practical next steps.
• Judgment about what to address immediately, what to plan for, and when to escalate.
Relevant Areas
• HIPAA and healthcare data security
• Azure cloud and AKS / Kubernetes security
• Access and secrets management
• Patient-data flows and technical safeguards
• Vendor and AI-tool risk
• Customer security reviews
• Control evidence and audit preparation
• Incident response
• Security roadmap prioritization
Nice to Have
• SOC 2 or HITRUST experience
• Azure security experience
• Experience building a program at an early-stage startup
• Experience assessing AI/LLM vendors and agent access to sensitive data
Schedule
This is a part-time, remote role of approximately 8–10 hours per week, requiring regular live collaboration with our US-based founder and India-based engineering team. India-evening overlap is expected; the specific hours will be confirmed during hiring.
Significant security incidents may occasionally require coordination outside the usual collaboration window.
Compensation and Benefits
• Competitive compensation, based on demonstrated expertise and experience
• Fully remote work
• Equipment allowance
• Direct access to the founder and Head of Engineering
• Significant ownership of the security and compliance foundations of an AI-native healthcare company
Who Will Thrive in This Role
This role is well suited to someone who:
• Has real healthcare security and HIPAA experience.
• Can combine policy knowledge with technical review.
• Enjoys building a program and developing the people who operate its controls.
• Prioritizes clearly instead of treating every finding as equally urgent.
• Follows through from recommendation to implementation and verification.
• Can balance startup speed with disciplined protection of patient data.
You may struggle if you prefer to advise from a distance, produce generic documentation without verifying implementation, or need a large established security team and budget to make progress.
If you want to own the security and compliance program for an AI-native health-tech company—and build foundations that work in practice—we would love to hear from you.
New Zealand