IT & Security Program Manager
WellHive operates a healthcare technology platform under HIPAA, and we're pursuing
organization-level certifications including HITRUST and SOC 2 Type 2. We're maturing our
corporate IT and security posture across our SaaS and endpoint estate, and we're hiring a
program manager to own that effort end to end.
You'll drive a roadmap of security hardening initiatives across our SaaS tools, direct the external
IT partner(s) who carry out implementation, make and validate the day-to-day technical
decisions, and run the testing and rollout. You'll also be the IT/security point person for our
org-level audits — owning the corporate-IT control domains, maintaining evidence, and
engaging assessors directly. You'll work with leadership on the calls that matter (risk, budget,
compliance posture) and own everything below that line.
This is a senior, hands-on role. You should be as comfortable in an admin console validating a
configuration as you are running a program plan, holding a contractor to a statement of work, or
walking an assessor through a control.
Responsibilities
- Own a multi-effort IT/security hardening roadmap and drive it to delivered, validated
controls.
- Direct external IT partner(s) on implementation: scope, acceptance, quality.
- Make and defend implementation and sequencing decisions; escalate risk and budget.
- Run validation, phased rollout, and user-facing change.
- Keep the work aligned to HIPAA and to HITRUST / SOC 2 Type 2.
- Own corporate-IT control domains for our audits, maintain evidence, and engage
Assessors.
Requirements
- Senior IT/security experience with hands-on IAM and SaaS administration.
- A track record in a regulated environment (HIPAA, SOC 2, HITRUST, or similar).
- Experience engaging auditors/assessors and maintaining control evidence (HITRUST
CSF or SOC 2 a plus).
- Experience managing contractors/MSPs to a statement of work.
- The judgment to make technical security decisions independently.
- Program management across concurrent workstreams.
Nice to Have
- Google Workspace and/or Okta administration depth; DLP and device-management
(Jamf / Kandji / Intune) familiarity; IaC literacy.
Originally posted on