About the JobAs our
Compliance Lead, you'll own and operationalize our compliance program - turning our regulatory obligations into a scalable, audit-ready system that earns the trust of health systems, investors, and the patients behind the data. Avandra handles protected health information across a growing network of health system partners.
This is a build role. You'll work alongside our IT & Security Manager, contributing to security posture while owning the compliance workstream end-to-end. If you're energized by standing up programs - not just maintaining them - this is your role.
What You'll DoCompliance Program Management- Own Avandra's compliance roadmap across HIPAA, HITRUST, and SOC 2; drive certification timelines and recertification cycles.
- Maintain the risk register and conduct company-wide risk assessments on a defined cadence.
- Author, publish, and maintain security and compliance policies and procedures.
- Evaluate emerging frameworks (ISO 27001, NIST CSF) for relevance as we scale.
Audit & Evidence Readiness - Coordinate evidence collection, gap assessments, and control testing across Engineering, Operations, and People teams.
- Manage audit relationships with external assessors and compliance-automation platforms.
- Maintain audit-ready documentation at all times - not just at audit season.
Vendor Risk Management - Own the vendor security intake and assessment process.
- Respond to customer security questionnaires, RFPs, and due diligence requests; represent Avandra'scompliance posture credibly to health system partners.
M&A Compliance Integration - Conduct compliance assessments for acquisition targets - evaluate PHI handling practices, existing certifications, policy maturity, and open audit findings.
- Own the post-acquisition compliance integration playbook: gap analysis, remediation roadmap, and timeline to bring acquired entities under the Avandra compliance umbrella.
- Assess and rationalize subsidiary compliance programs; identify redundancies, coverage gaps, and certification consolidation opportunities.
- Serve as the compliance integration contributor in cross-functional M&A workstreams alongside Legal, Finance, and Engineering.
- Maintain a consolidated compliance posture across all entities - ensuring no subsidiary operates outside Avandra's policy and control framework.
Training & Culture - Develop and deliver company-wide compliance training, including onboarding programs tailored to acquired teams.
- Translate complex regulatory requirements into clear, actionable guidance for non-compliance teams.
What You'll NeedRequired - 5+ years of hands-on compliance experience at a B2B SaaS or healthcare technology company.
- Demonstrated ownership of HIPAA compliance programs; working knowledge of HITRUST (i1 or r2).
- SOC 2 Type II experience - you've coordinated evidence, managed auditors, and closed gaps.
- Ability to work cross-functionally with Engineering on technical controls without needing a translator.
- Strong written communication - policy writing, questionnaire responses, and executive summaries are all in your wheelhouse.
- Self-starter mentality; you build structure in ambiguity.
Preferred - Experience supporting compliance assessments or integration work in M&A contexts.
- Familiarity with multi-entity or subsidiary compliance program management.
- CISSP, CISM, HCISPP, or equivalent certification.
- Experience with compliance automation tooling (Vanta, Drata, Tugboat Logic, etc.).
- Familiarity with PHI data flows, health data integrations, and healthcare data contracts.
- Prior experience at a growth-stage startup where the compliance program was being created, not inherited.
What We Offer- Meaningful Impact: The work we do directly enables medical breakthroughs - such as earlier cancer detection, better Alzheimer's treatments, AI diagnostics that save lives. This isn't abstract; it's the reason our health system partners invest in us.
- Career-Defining Opportunity: You'll have a front-row seat to every aspect of building a category-defining company-strategy, operations, fundraising, M&A, scaling.
- Exceptional Team: Work alongside a founder with a track record of building and exiting healthcare technology companies, backed by investors who are true partners.
- Competitive Package: Competitive salary, equity, comprehensive benefits, and hybrid work flexibility.
- Values-Driven Culture: We're building a team grounded in Avandra's 5 Core Values that guide how we show up every day:
- WIN with Integrity
- Radical Accountability
- Engage with Empathy
- Innovation Through Playful Curiosity
- Patients First
