SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 230,000 - 265,000 / annual
Knit Health is building a clinical foundation model to improve healthcare delivery, combining AI expertise with deep clinical knowledge to create safe, trustworthy systems for healthcare providers. The company is venture-backed, led by a founding team with roots at UC Berkeley, and is now bringing on enterprise customers starting with pilots.
You will be Knit's first in-house Head of Security & Compliance, building the security function from the ground up. This is a hands-on leadership role where you will set the security vision and roadmap, represent Knit credibly to customers, auditors, and health-system security reviewers, and personally execute early-stage program work including writing policies, gathering audit evidence, configuring tools, and closing security gaps.
Key responsibilities include:
**Security Leadership & Vision**: Own Knit's overall security strategy and roadmap aligned with the company's stage, risk profile, and growth as a healthcare AI company handling sensitive clinical data. Serve as the security executive to customers, prospects, auditors, and partners, answering security questionnaires and leading security reviews. Build a security-aware engineering culture with clear guidance on data handling and secure coding practices. Advise leadership, investors, and the board on security risk, incident response readiness, and compliance posture in business-relevant terms.
**Compliance & Audit Readiness**: Take ownership of compliance programs, building on the completed SOC 2 Type 1 audit and leading the next stage of HIPAA compliance as workloads move into Knit's own environment. Gather, organize, and validate audit evidence, run control testing, and manage certification and renewal cycles. Build and maintain policies, procedures, and documentation that controls rely on. Lead evaluation of HITRUST certification timing and necessity.
**Program & Infrastructure Build-Out**: Design and implement practical security program building blocks including access management, vendor risk reviews, endpoint and cloud security configuration, logging and monitoring, and incident response plans. Audit and validate cloud, development systems, SaaS tools, and data pipelines, working alongside platform engineers and IT/SecOps partners to verify systems and drive fixes. Own the security and compliance budget including tooling, vendors, training, and contracted audit support. Own the incident response program, keeping plans current and leading response from detection through resolution and any required notifications.
**Data Protection & Risk Management**: Ensure appropriate safeguards for clinical data, PHI, and sensitive information, including with respect to AI/ML products, AI-assisted development workflows, and data pipelines. Run ongoing risk assessments and vendor security reviews as Knit's partner and data-provider relationships grow.
You will lead a cross-functional team spanning operations, engineering, IT, and external partners. While these team members don't report directly to you, you'll own the security outcomes they deliver. As the company grows, you'll have the opportunity to build out a dedicated security team.
**Requirements**:
- Prior experience as a senior security leader at a healthcare technology or health data company of roughly 50–1,000 people, owning a program with real external demands (enterprise customers, third-party audits, regulatory requirements)
- Direct ownership of a HIPAA program and a SOC 2 Type II (or comparable, such as HITRUST or ISO 27001) audit, including personally doing evidence, policy, questionnaire, and contract review work, not only overseeing it
- Strong working knowledge of cloud security (AWS, Azure, or GCP), identity and access management, and common SaaS security tooling, including the ability to directly review code and infrastructure
- Experience representing security to external audiences (customers, auditors, or partners) including completing security questionnaires and leading review calls
- Excellent written and verbal communication skills, with the ability to translate technical risk into terms a non-technical audience (leadership, customers, sales) can act on
- Comfortable operating with significant autonomy in a fast-moving, resource-constrained startup environment; energized by being a team of one
- Track record of driving security outcomes through cross-functional teams you don't directly manage, including engineering and IT, and resolving competing priorities through planning and collaboration
**Nice-to-haves**:
- Experience securing AI/ML systems, LLM-based products, or data pipelines feeding machine learning models
- Knowledge of Python, SQL, and Terraform
- Relevant security certification (e.g., CISSP, CISM, or similar)
- Prior experience transitioning a company from an outsourced or fractional security function to an in-house program
