Description
About Rethink First
Rethink First is a leading behavioral health technology company working to make mental wellness, education, and support accessible and scalable. Through our suite of cloud-based platforms—including RethinkEd, RethinkCare, and RethinkBH—we serve educators, employers, and providers with tools that deliver measurable, inclusive outcomes.
We're on a mission to make behavioral health more effective, equitable, and human—and we're looking for a creative visionary to help lead that charge.
About the Role
We are building a modern, cloud-forward security program grounded in Cyber Resilience, Application Security, and Security Assurance. As our Manager, Information Security, you will be the operational and execution leader for our Security Assurance function while helping shape key processes across SecOps and AppSec.
This role is ideal for someone who thrives in a high-growth SaaS environment, collaborates well cross-functionally, and wants to help mature a security program that must support HIPAA, SOC 2 Type II, HITRUST, and a broad healthcare customer base.
You will own the day-to-day execution of GRC, Audit Readiness, Evidence Collection, Policy Management, TPRM, and Client Trust—and must have hands-on experience implementing or operating Vanta as a centralized compliance automation platform.
You will serve as a multiplier for the Sr Director, creating repeatable processes, driving deadlines, maturing documentation, and ensuring audit-ready control operation across Azure, M365, and our SaaS product ecosystem.
Key Responsibilities
Security Assurance Leadership (Primary Responsibility 60%)
- Lead the end-to-end Security Assurance function across SOC 2, HIPAA, HITRUST, and regulatory frameworks.
- Act as the program manager for all audits, coordinating with Legal, HR, Engineering, Product, and Infrastructure to maintain year-round audit readiness.
- Own the implementation, configuration, optimization, and continuous operation of Vanta, including:
- Control mapping and ownership assignments
- Evidence collection workflows
- Vendor risk management modules
- Client Trust functionality (best answers, trust portal, knowledge base)
- Build and maintain an audit calendar, evidence repository, and standardized evidence collection playbooks.
- Drive development and continuous maintenance of security policies, standards, and procedures.
- Operate the Third-Party Risk Management process, including vendor classification (Tier 1/BAA), questionnaire review, residual risk scoring, and contract security review.
- Respond to customer security questionnaires, RFPs, and client audit requests with clarity, accuracy, and speed.
Cyber Resilience & SecOps Leadership (25%)
- While not a hands-on SecOps role, you will:
- Partner with the SecOps Engineers to build daily operational cadence across alerts, incidents, vulnerability management, and hygiene controls.
- Ensure controls monitored by Tenable, Microsoft Defender, Sentinel, and other platforms produce audit-ready evidence.
- Help design operational dashboards and KPIs for incident response, vulnerability SLAs, and hygiene metrics.
- Validate operational controls for compliance frameworks (MFA, SSO, logging, monitoring, access reviews, backups, endpoint security, network protections, etc.).
Application Security Collaboration (15%)
- Work with Engineering, Architecture, and DevOps teams to ensure Product and AppSec controls align with SOC 2 and HITRUST expectations.
- Contribute to secure SDLC processes, risk assessments for new features, and remediation tracking for vulnerabilities and findings.
- Validate that security requirements are integrated into CI/CD workflows where appropriate.
Required Qualifications
- 7+ years of progressive experience in Information Security, with at least 3+ years in a governance, compliance, or Security Assurance leadership role.
- Direct experience implementing or operating Vanta (must be hands-on).
- Strong experience supporting and maturing SOC 2 Type II, HIPAA Security Rule, and HITRUST programs in a SaaS environment.
- Deep understanding of Microsoft Azure security architecture, including Entra ID, RBAC, Conditional Access, Defender for Cloud, Sentinel, and workload identities.
- Clear understanding of audit control design, evidence, and auditor expectations.
- Experience building vendor risk programs, reviewing DPAs and BAAs, and performing vendor due diligence.
- Excellent writing skills for policies, procedures, client responses, and audit documentation.
- Demonstrated ability to lead complex projects with multiple stakeholders and tight deadlines.
- Strong communication and relationship-building skills across technical and non-technical teams.
Preferred Qualifications
- Experience in healthcare SaaS or other regulated industries.
- Hands-on experience with:
- Vanta Vendor Risk + Trust Center
- Microsoft Purview (DLP, Information Protection)
- Azure DevOps or GitHub governance
- Tenable, Defender, or other vulnerability platforms
- Jira/Confluence
- Certifications such as CISA, CISSP, HCISPP, HITRUST CCSFP, or similar.
- Experience working with offshore teams.
Benefits:
- Generous health, dental, & vision benefits package
- Flexible paid time off
- 11 paid company holidays
- 401k + matching
- Parental leave
- Access to our award-winning RethinkCare platform supporting neurodiversity in the workplace through parental success, professional resilience, and personal wellbeing.
Location: Remote opportunities are available to candidates who reside in the following states: AL, AZ, CT, FL, GA, HI, IA, IL, IN, KY, LA, MD, MA, MI, MN, MO, MT, NC, NE, NH, NJ, NV, OH, OR, PA, RI, TN, TX, VA, WA, WI, WY
Our commitment to an inclusive workplace
RethinkFirst is an equal opportunity employer and is committed to providing a workplace free from harassment and discrimination. We celebrate the unique differences of our employees because that is what drives curiosity, innovation, and the success of our business. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, status as a protected veteran, or any other protected category under applicable federal, state, and local laws. Accommodations are available for applicants with disabilities.
#remote
Powered by JazzHR
PI280736785