7+ years in security, IT, or compliance, with 2+ years in a leadership role
Direct experience managing a SOC 2 audit from readiness to report
Knowledge of HIPAA security requirements and handling PHI
Hands-on experience with IAM/SSO tools like Okta or Google Workspace
Experience in vulnerability management and incident-response planning
Proven ability to assess and manage third-party vendor risk
Strong communication skills for engaging with diverse stakeholders
Responsibilities
Own and manage compliance programs including SOC 2 and HIPAA
Drive audit readiness and lead evidence collection across the organization
Write and enforce security and compliance policies
Manage corporate IT functions including device management and IAM
Design and implement security controls and conduct risk assessments
Run security awareness training for employees and contractors
Oversee vendor security assessments and manage ongoing vendor risks
Benefits
Opportunity to shape security and IT functions from the ground up
Collaborative environment working closely with Engineering
Hands-on role with both strategic and tactical responsibilities
Potential for growth as the company scales
Engagement with diverse stakeholders including customers and auditors
Full Job Description
The Role
SuperDial is hiring its first Head of Security & IT: a hands-on leader who will own the company's security, compliance, and corporate IT functions end to end.
This is a builder role. You will set the security strategy, run our compliance programs, and keep our people, devices, and vendors secure, while partnering closely with Engineering on the security of the product itself. You will be the person customers, auditors, and leadership turn to when they need confidence that SuperDial is secure.
Success means audit-ready compliance programs, a corporate IT environment that is secure by default, and a security posture that scales with the company rather than slowing it down.
This role is based in our San Francisco office and reports to [reporting line - confirm]. What You'll Own
Compliance programs
Own SuperDial's compliance programs end to end, including SOC 2 and HIPAA (and future frameworks as customer needs evolve)
Drive audit readiness and lead evidence collection across the company
Write, maintain, and enforce security and compliance policies
Manage relationships with auditors and compliance vendors
Identify and close compliance gaps before they become customer or audit issues
Corporate IT
Manage devices, identity and access management (IAM), and SSO across the company
Enforce VPN usage and endpoint protection on all company devices
Administer core software and SaaS tools, including provisioning and license management
Oversee contractor-delivered IT support and hold vendors to clear service standards
Information security
Design, implement, and monitor security controls across the company
Run regular risk assessments and maintain the risk register
Lead vulnerability management, from identification through remediation
Own security monitoring arrangements, whether in-house or through managed providers
Build and test incident-response plans so the company is ready before an incident occurs
Employee lifecycle and training
Run security awareness training for all employees and contractors
Own the security side of onboarding and offboarding, partnering with People Ops
Ensure timely access provisioning and removal across all systems
Maintain the documentation that supports these processes for audits
Application security
Schedule and manage penetration tests, and define testing scope with Engineering
Track findings and drive remediation to closure with engineering owners
Partner with Engineering on secure development practices; you are accountable for the program, not for personally performing every technical review
Third-party security
Run vendor security assessments before onboarding new tools and partners
Manage vendor access controls and conduct ongoing reviews
Track vendor-related risks and contractual security obligations
Respond to customer security questionnaires and support security reviews in the sales process
What You Bring
7+ years in security, IT, or compliance, including at least 2 years leading a security or IT function
Direct ownership of a SOC 2 audit (Type II preferred) from readiness through report
Working knowledge of HIPAA security requirements and handling of protected health information (PHI)
Hands-on experience administering IAM/SSO (e.g., Okta, Google Workspace), MDM, and endpoint protection tools
Experience running vulnerability management, penetration testing programs, and incident-response planning
Experience assessing and managing third-party vendor risk
Comfort being both strategic and hands-on: writing the policy, configuring the tool, and presenting to leadership
Clear, confident communication with engineers, executives, auditors, and customers alike
Nice to Have
Experience as the first security or IT hire at a venture-backed startup
Background in healthcare technology, revenue cycle management, or another regulated industry
Familiarity with compliance automation platforms (e.g., Vanta, Drata)
Exposure to cloud security (AWS or GCP) and AI/ML systems handling sensitive data
Relevant certifications such as CISSP, CISM, CISA, or Security+
