WellHive

Compensation

Full Description

IT & Security Program Manager WellHive operates a healthcare technology platform under HIPAA, and we're pursuing organization-level certifications including HITRUST and SOC 2 Type 2. We're maturing our corporate IT and security posture across our SaaS and endpoint estate, and we're hiring a program manager to own that effort end to end. You'll drive a roadmap of security hardening initiatives across our SaaS tools, direct the external IT partner(s) who carry out implementation, make and validate the day-to-day technical decisions, and run the testing and rollout. You'll also be the IT/security point person for our org-level audits — owning the corporate-IT control domains, maintaining evidence, and engaging assessors directly. You'll work with leadership on the calls that matter (risk, budget, compliance posture) and own everything below that line. This is a senior, hands-on role. You should be as comfortable in an admin console validating a configuration as you are running a program plan, holding a contractor to a statement of work, or walking an assessor through a control. Responsibilities - Own a multi-effort IT/security hardening roadmap and drive it to delivered, validated controls. - Direct external IT partner(s) on implementation: scope, acceptance, quality. - Make and defend implementation and sequencing decisions; escalate risk and budget. - Run validation, phased rollout, and user-facing change. - Keep the work aligned to HIPAA and to HITRUST / SOC 2 Type 2. - Own corporate-IT control domains for our audits, maintain evidence, and engage Assessors. Requirements - Senior IT/security experience with hands-on IAM and SaaS administration. - A track record in a regulated environment (HIPAA, SOC 2, HITRUST, or similar). - Experience engaging auditors/assessors and maintaining control evidence (HITRUST CSF or SOC 2 a plus). - Experience managing contractors/MSPs to a statement of work. - The judgment to make technical security decisions independently. - Program management across concurrent workstreams. Nice to Have - Google Workspace and/or Okta administration depth; DLP and device-management (Jamf / Kandji / Intune) familiarity; IaC literacy.