About HIPAA Vault
HIPAA Vault is a leading managed cloud and compliance provider for healthcare. We keep thousands of managed sites secure and audit-ready across HIPAA Linux, WordPress, Windows, and WooCommerce hosting, Google Cloud Platform, and secure workspace services (HIPAA Gmail, O365, Forms, Fax, Text, and sFTP) — backed by 24/7 support, a <15-minute critical response time, and 90% first-call resolution. Our clients trust us because real engineers do the work, and here compliance means secure systems, not just secure paperwork.
The Role
This is a hands-on Compliance Analyst role for someone who fixes things, not just flags them. You'll live in the servers, cloud consoles, and ticket queue — hardening systems, remediating vulnerabilities to closure, driving incident response, and keeping our HIPAA / SOC 2 / NIST posture backed by real technical evidence. You'll work alongside our security and systems team in a fast-moving, 24/7 managed-hosting environment.
If your idea of compliance is writing policies and filling out questionnaires, this isn't the role. If you like getting on a Linux box and closing the finding, read on.
What You'll Do
• Remediate vulnerabilities end-to-end — triage scanner output (Rapid7 or similar), verify findings, apply fixes across Linux and Windows servers, and confirm closure. Own the result, not just the report.
• Secure our WordPress fleet at scale — patch core/plugins/themes, harden configurations, and help automate updates across large numbers of sites.
• Harden cloud infrastructure on Google Cloud Platform — IAM/least-privilege, Cloud Armor / WAF policies, and secure configuration baselines.
• Drive incident response from detection through root-cause analysis and written RCA, coordinating with the team inside our 24/7 response SLAs.
• Operate encryption and BAA controls — configure and validate encryption for HIPAA Gmail, O365, Fax, and file transfer; manage BAAs as living controls, not a spreadsheet.
• Assist customers with audits and security questionnaires — a weekly, customer-facing activity: help clients accurately complete HIPAA audits, third-party security assessments, and vendor risk questionnaires, and get them submitted on time.
• Run risk assessments and audits and maintain HIPAA / SOC 2 / NIST / HITECH evidence drawn directly from the systems we manage.
• Deliver security awareness training (including phishing simulations) and answer daily customer compliance questions.
• Build repeatable process — log every finding in our tracking system, create and manage tasks, document runbooks, and turn recurring manual checks into automation.
What Success Looks Like (First 90 Days)
• Vulnerabilities are triaged, remediated, and verified closed on a predictable cadence with the process documented.
• Every security observation lives in the central tracking system, not in chats or memory.
• At least one recurring manual check is automated or captured in a runbook a teammate can follow.
Must-Have Qualifications
• 5+ years in a security/compliance role with direct, hands-on remediation experience on production systems (not purely advisory, audit-observer, or policy-writing).
• Strong working command of Linux (command line, hardening, least privilege) and familiarity with Windows server administration.
• Experience with vulnerability scanners (Rapid7, Nessus, or equivalent) — including interpreting failed-asset/authentication results and acting on them.
• Demonstrated experience taking a security incident from detection to a written RCA and verified remediation.
• Working knowledge of HIPAA (Security Rule / technical safeguards); familiarity with SOC 2, NIST, or HITECH.
• Strong documentation and process discipline — clear runbooks, and a ticketing/task system kept as the source of truth. Non-negotiable.
• Client-facing communication skills — comfortable working directly with customers to guide them through audits, security questionnaires, and compliance questions, clearly and professionally (written and verbal).
• Availability for a rotating on-call schedule in our 24/7 environment.
• Reliable high-speed internet (min. 100 Mbps down / 10 Mbps up) for remote work.
Preferred (Not Required)
• CompTIA Security+ (or willing to earn it early — we sponsor certifications).
• CISSP or CISM — or CISSP-eligible and on track to earn it (we support this path).
• Google Cloud Platform security experience (IAM, Cloud Armor/WAF); AWS a plus.
• WordPress security/patching at scale; cPanel hardening; managed-hosting background.
• Scripting/automation (Bash, Python, Salt, or config management).
• Experience with email/data encryption (O365, Google Workspace) or secure fax/file transfer.
• Residence in a federal HUBZone (supports our government-contract eligibility).
Benefits
• Medical insurance, holiday pay, and accrued paid time off
• 401(k) with 4% employer match (5% employee contribution, after 12 months)
• Fully remote, work-from-home
• Training and certification support to grow your security career (Security+, CISSP, and more)
• A small, close-knit team where you'll talk directly to the people doing the work
Etica, Inc. is an equal opportunity employer in accordance with U.S. law.
Pay: $38.00 - $48.00 per hour
Education:
• Bachelor's (Required)
Experience:
• hands-on Linux: 3 years (Required)
• personally performing incident response and remediation: 2 years (Required)
• penetration testing or offensive security: 1 year (Required)
Work Location: Remote