Senior Compliance Specialist

Reporting to the Manager, IT & Compliance, the Senior Compliance Specialist will assist with all matters relating to Information Security compliance including SOC 2 Type II, HITRUST, Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), ISO 27001, ISO 42001 and ITGC-SOX.

What You’ll Be Doing:

Primarily lead your assigned IT Compliance Program as outlined below, but not limited to the following

Develop, execute and ensure adherence to existing and planned compliance programs : Existing : SOC2 / HITRUST / HIPAA and GDPR Compliance; Planned: ISO 27001 / ITGC SOX / FedRAMP etc.
Expedite AI adoption with the implementation of required AI compliance programs such as ISO 42001, NIST AI RMF
Lead and manage annual assessment and audit related works (assessment planning, internal assessments, actual assessment interviews, evidence requests coordination, remediation coordination etc.) with external (external assessors other certification authorities) and internal stakeholders (organization wide engineering teams)
Provide timely updates and escalations to leadership.
Use, manage and maintain the GRC tool for effective compliance initiatives and activities
Perform internal information security risk assessments, document control deficiencies, and develop recommendations for improvement
Develop required plans, policies, procedures and SOPs to support compliance assessments and build better security posture for Spring Health.
Conduct continuous monitor activities by regularly - documenting updates to artifacts, risk management, access reviews etc.
Think out of the box and develop solutions to bring more automation and efficiency

Supporting the IT Compliance team with the following responsibilities, but not limited to:

Conduct Gap Assessments, develop remediation plans in coordination with required stakeholders
Support Remediation Tracking and Implementation
Execution of Supply Chain and Third Party Vendor Management Program
Support Customer Assurance Program - support customer calls, responding to customer questionnaires etc.
Evolve, execute and delivery of information security and privacy awareness training and other role based trainings programs to build security aware organizational culture

What success looks like in this role:

ISO 27001 / 42001 Planning and Execution
Maintain and ensure security audit compliance in accordance with HITRUST and SOC 2
Ensure achievement of team KPIs around regulatory compliance and process improvements

What we expect from you:

Bachelor’s degree plus 5+ years of experience in a compliance focused role.
You MUST have substantial ISO 27001 experience with in-depth knowledge of ISO 27001 standards management and implementation.
Emerging ISO 42001, NIST AI RMF or any other AI compliance experience
Experience with other common security frameworks and regulations such as SOC2, HIPAA, GDPR, HITRUST and SOX
Demonstrated understanding of emerging information security trends, including changes to security frameworks and regulatory requirements
Self-starter, organized, efficient, and proactive
Strong communication and cross organization collaboration skills

Added bonus if you have:

Experience with FedRAMP (Federal Risk and Authorization Management Program) compliance and regulations
Relevant certifications such as CISA, CRISC, CISSP, or ISO 27001 Lead Implementer/Auditor are highly desirable
Experience with OneTrust

The target base salary range for this position is $125,000 - $145,850, and is part of a competitive total rewards package including stock options and benefits. Individual pay may vary from the target range and is determined by a number of factors including experience, location, internal pay equity, and other relevant business considerations. We review all employee pay and compensation programs annually at minimum to ensure competitive and fair pay.

Don’t meet every requirement? Studies have shown that women, communities of color and historically underrepresented talent are less likely to apply to jobs unless they meet every single qualification. At Spring Health we are dedicated to building a diverse, inclusive and authentic workplace, so if you’re excited about this role but your past experience doesn’t align perfectly with every qualification in the job description, we strongly encourage you to apply. You may be just the right candidate for this or other roles!

Ready to do the most impactful work of your life? Learn more about our values, how we work, and how hypergrowth meets impact at Spring Health: Our Values

Hypergrowth meets impact

What to expect working here:

You will be held accountable to an exceptionally high bar and impact
This may be the fastest work environment you will ever experience in terms of growth, decision-making, and time to impact
You will be empowered to set your own boundaries and asked to adapt them in critical moments when the company needs you
You will create processes & products that have never existed before
You will have very direct conversations and receive continuous feedback to push you to become the most thriving team member and performer you can be
Change is a constant here: your role, team, responsibilities, and success metrics will shift as the company grows

And…

You get to be surrounded by some of the brightest minds in the field
You get to learn and grow at an extremely accelerated pace
You will experience transparency, integrity, & humility from leadership
You will be empowered to constantly challenge the status quo
You get the space to experiment & innovate
You get to make a transformational impact for the company, mental health, and for real human lives — and you will see that impact quickly
You will become more resourceful and resilient
You get to be part of a winning team that opens doors in the future

Benefits provided by Spring Health:

Your Total Health:

Health, Dental, Vision benefits start on your first day at Spring Health. You and your dependents also receive an individual One Medical account which is valued at $199/year per user. HSA and FSA plans available
A yearly allotment of no cost visits to the Spring Health network of therapists, coaches, and medication management providers for you and your dependents
10 allocated sick days per year
Flexible paid time off in addition to 12 paid holidays throughout the year
Access to Gympass, an on-demand virtual benefit that provides wellbeing coaching, and budget management.
Spring Renewal: When you hit your four-year Springaversary, you’ll be awarded a four week, fully paid, sabbatical leave to renew and recharge.

You And Your family:

4-4.5 months of fully paid parental leave
Spring Health provides team members and their families with sponsored access to Bright Horizons® child care, back-up care, and elder care.
Access to fertility care support through Carrot, in addition to $4,000 reimbursement for related fertility expenses

Supporting you financially through:

Our People team benchmarks all salaries using the Radford Global Compensation Database for technology and life sciences industries. Radford benchmarks salaries with 3,589 global firms, 6.5 million employees, and 98 countries across the globe. We do this to ensure all of our team members are paid equally and competitively.
On top of competitive and benchmarked salary, Spring Health offers incentive pay (based on role), and equity that begins vesting as we celebrate your first year with the company!
Employer sponsored 401(k) match of up to 2% after 90 days of employment

Creating a culture you can thrive in:

Flexible work arrangements: 66% of Spring Health team members work fully remote while 33% work in a hybrid model from our New York City offices
Focus Fridays: no meetings, no distractions, just time for you to get work done.
Focus Weeks: In Spring 2023, we held our first ever Focus Week, we canceled all non-essential meetings, minimized distractions, and you, our team members, to dive into the key work that gets chopped up or deprioritized during the regular day-to-day. We saw a 36% jump in the average energized score after those five days of flow state work and are finalizing a plan for quarterly Focus Weeks for team members.
Up to $1,000 Professional Development Reimbursement per calendar year.
$200 per year donation matching to support your favorite causes

Our privacy policy: https://springhealth.com/privacy-policy/

To ensure intentional and equitable hiring practices, we use a balanced candidate slate in our interviews. This approach guarantees that our pool of qualified candidates includes individuals who are underrepresented in our organization at all levels. This is a key performance indicator (KPI) for our recruiting and hiring teams, reported quarterly to maintain accountability.