Hippocratic AI - Global Risk Compliance
Requirements
• Cloud and federal compliance: Drive GovCloud and FedRAMP High / NIST SP 800-171 workstreams, including control mapping, documentation, and authorization evidence. • Cloud and federal compliance: • Policy management: Draft, update, and communicate internal and external compliance policies. • Policy management: • Risk, Privacy & Governance • Enterprise risk: Partner with the CISO and stakeholders to identify, assess, and prioritize IT and security risks; maintain the risk framework and register and run quarterly risk reviews. • Enterprise risk: • Vendor risk: Execute third-party (and fourth-party) compliance and risk assessments. • Vendor risk: • Data privacy: Lead Data Protection Impact Assessments (DPIAs), internal privacy reviews, data residency and regulatory analysis, and privacy documentation (records of processing, data maps, privacy notices) for U.S. and international jurisdictions. • Data privacy: • AI governance: Conduct governance reviews against emerging AI laws and regulations and translate requirements into program controls. • AI governance: • Audit, Assurance & Program Operations • Audits and customer assessments: Serve as the lead and central point of contact for external audits and customer security assessments; manage and execute security questionnaires, RFP responses, customer calls, and follow-ups, pairing AI-assisted drafting with rigorous human review. • Audits and customer assessments: • Annual assessments and renewals: Conduct and oversee customer annual assessments and renewals, with a focus on payor-side compliance requirements and provider third-party risk management (TPRM) portals. • Annual assessments and renewals: • Presentations: Deliver customer-facing and internal presentations on our security and compliance program, including customer security reviews, sales support calls, executive briefings, and team training sessions. • Presentations: • Trust center and dashboards: Own audit dashboards and the public trust center (Vanta); keep published evidence, policies, and certifications current; program-manage internal non-compliance processes through remediation. • Trust center and dashboards: • Metrics and reporting: Build and maintain a metrics and reporting framework that measures program effectiveness and raises security maturity, including clear, actionable leadership reports and tabletop exercises. • Metrics and reporting: • Training and culture: Design and deliver targeted training on patient privacy, data security, and regulatory requirements; foster a culture of compliance across clinical, administrative, and technical teams. • Training and culture: • Bachelor's degree; CISM, CRISC, CHPC, or similar certifications preferred. • 5+ years in GRC, compliance, or audit, ideally in a healthcare or payor environment. • Strong working knowledge of healthcare regulations and frameworks, including HIPAA, HITRUST, SOC 2, and ISO 42001. • Working knowledge of international data protection and privacy law (GDPR and UK GDPR, cross-border transfers, data residency) and experience translating it into operational controls. • Hands-on experience with customer security assessments, TPRM portals, and GRC or trust-center tooling (e.g., Vanta). • Proven experience leading risk assessments, audits, vendor risk reviews, and compliance reviews, with strong analytical, problem-solving, and communication skills. • Confident presenter able to explain complex security and compliance topics clearly to customers, executives, and non-technical audiences. • Startup experience; comfortable operating with ambiguity and minimal supervision. • Detail-oriented, organized, and adaptable, with high integrity, discretion, and ethical standards; collaborates effectively across clinical, administrative, and technical teams. • Experience with FedRAMP High, GovCloud, and NIST SP 800-53 / 800-171, including authorization or readiness efforts for federal customers. • Experience in a pharma or life-science environment, including quality and validation frameworks such as GxP, GAMP 5, CSV, 21 CFR Part 11, and ALCOA+, and exposure to SaMD or ISO 13485.
Responsibilities
• Certifications, Frameworks & Compliance Programs • Framework and certification oversight: Maintain SOC 2 (including expansion of Trust Services Criteria), HITRUST, and HIPAA Privacy and Security attestations, along with data de-identification standards and applicable CMS regulations and federal guidelines. • ISO 42001 AI Management System: Implement and manage the AIMS program; drive gap remediation through a successful certification audit targeted for 2027. • International data compliance: Lead readiness and compliance workstreams for international expansion, including GDPR and UK GDPR, cross-border transfer mechanisms, in-country data residency requirements, and local healthcare and AI regulations (e.g., the EU AI Act) as we enter new markets. • Emerging requirements: Monitor and operationalize new state, federal, and international obligations (e.g., DATC) as they apply to our business. • Cloud and federal compliance: Drive GovCloud and FedRAMP High / NIST SP 800-171 workstreams, including control mapping, documentation, and authorization evidence. • Policy management: Draft, update, and communicate internal and external compliance policies. • Risk, Privacy & Governance • Enterprise risk: Partner with the CISO and stakeholders to identify, assess, and prioritize IT and security risks; maintain the risk framework and register and run quarterly risk reviews. • Vendor risk: Execute third-party (and fourth-party) compliance and risk assessments. • Data privacy: Lead Data Protection Impact Assessments (DPIAs), internal privacy reviews, data residency and regulatory analysis, and privacy documentation (records of processing, data maps, privacy notices) for U.S. and international jurisdictions. • AI governance: Conduct governance reviews against emerging AI laws and regulations and translate requirements into program controls. • Audit, Assurance & Program Operations • Audits and customer assessments: Serve as the lead and central point of contact for external audits and customer security assessments; manage and execute security questionnaires, RFP responses, customer calls, and follow-ups, pairing AI-assisted drafting with rigorous human review. • Annual assessments and renewals: Conduct and oversee customer annual assessments and renewals, with a focus on payor-side compliance requirements and provider third-party risk management (TPRM) portals. • Presentations: Deliver customer-facing and internal presentations on our security and compliance program, including customer security reviews, sales support calls, executive briefings, and team training sessions. • Trust center and dashboards: Own audit dashboards and the public trust center (Vanta); keep published evidence, policies, and certifications current; program-manage internal non-compliance processes through remediation. • Metrics and reporting: Build and maintain a metrics and reporting framework that measures program effectiveness and raises security maturity, including clear, actionable leadership reports and tabletop exercises. • Training and culture: Design and deliver targeted training on patient privacy, data security, and regulatory requirements; foster a culture of compliance across clinical, administrative, and technical teams.
Benefits
• Reinvent healthcare with AI that puts safety first. We’re building the world’s first healthcare‑only, safety‑focused LLM — a breakthrough platform designed to transform patient outcomes at a global scale. This is category creation. • Reinvent healthcare with AI that puts safety first. • Work with the people shaping the future. Hippocratic AI was co‑founded by CEO Munjal Shah and a team of physicians, hospital leaders, AI pioneers, and researchers from institutions like El Camino Health, Johns Hopkins, Washington University in St. Louis, Stanford, Google, Meta, Microsoft, and NVIDIA. • Work with the people shaping the future. • Backed by the world’s leading healthcare and AI investors. We recently raised a $126M Series C at a $3.5B valuation, led by Avenir Growth, bringing total funding to $404M with participation from CapitalG, General Catalyst, a16z, Kleiner Perkins, Premji Invest, UHS, Cincinnati Children’s, WellSpan Health, John Doerr, Rick Klausner, and others. • Backed by the world’s leading healthcare and AI investors. • Build alongside the best in healthcare and AI. Join experts who’ve spent their careers improving care, advancing science, and building world‑changing technologies — ensuring our platform is powerful, trusted, and truly transformative. • Build alongside the best in healthcare and AI. • Equal Opportunity • Equal Opportunity
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT