Security Program Manager

About the role

As a Security Program Manager at Forus, you will own the programs that let customers trust us with their most sensitive data. We operate on protected health information to automate healthcare, and our providers, payers, and life sciences partners hold us to a high bar. You will own our compliance programs end to end - SOC 2, HIPAA, and HITRUST - and build the customer trust function that ensures security remains a core competency at Forus.

• Runs vendor and third-party risk assessments
• Stand up and administer compliance automation
• Partner closely with our engineering team to implement technical controls
• Translate framework and customer requirements into concrete controls
• Coordinate external auditors and penetration-testing firms
• Own the risk register and provide leadership with clear, honest visibility into our security and compliance posture

Responsibilities

• Own our compliance programs end to end (SOC 2 Type II, HIPAA, and HITRUST) from readiness through audit and continuous monitoring
• Build and run the customer trust function (security questionnaires, RFPs, due diligence, and our trust center) so security accelerates deals rather than blocking them
• Stand up and administer compliance automation, turning evidence collection and control monitoring into a continuous, low-toil system
• Author security policies, run security-awareness training, and drive access reviews and audit readiness across the company
• Partner with engineering and legal to translate framework and customer requirements into concrete controls
• Own the risk register and provide leadership with clear, honest visibility into our security and compliance posture

Requirements

• Typically 4–7 years in GRC, security compliance, or security program management, with a track record of running audits end to end
• Hands-on experience with SOC 2 and HIPAA; HITRUST experience is a strong plus, as is a track record of standing up a new framework from scratch
• Experience in a regulated, high-growth environment — ideally healthcare or another domain with serious data-handling obligations
• Fluency with compliance automation tooling and enough technical literacy to work credibly with engineers on cloud, identity, and logging controls
• Experience owning customer-facing security with enterprise buyers: questionnaires, trust centers, and due diligence
• Strong written and verbal communication that allows you to be an effective participant in both internal debates and external relationships
• A track record of moving quickly, finding shortcuts, and going to unreasonable lengths to deliver on goals
• A high NPS with your former teammates

Qualifications

• Typically 4–7 years in GRC, security compliance, or security program management, with a track record of running audits end to end
• Hands-on experience with SOC 2 and HIPAA; HITRUST experience is a strong plus, as is a track record of standing up a new framework from scratch
• Experience in a regulated, high-growth environment — ideally healthcare or another domain with serious data-handling obligations
• Fluency with compliance automation tooling and enough technical literacy to work credibly with engineers on cloud, identity, and logging controls
• Experience owning customer-facing security with enterprise buyers: questionnaires, trust centers, and due diligence
• Strong written and verbal communication that allows you to be an effective participant in both internal debates and external relationships
• A track record of moving quickly, finding shortcuts, and going to unreasonable lengths to deliver on goals
• A high NPS with your former teammates