IT Security Lead

QGenda is redefining healthcare workforce management everywhere care is delivered. We're on a mission to empower the healthcare industry to better onboarding, deploy, and manage their workforce. Over 4,500 healthcare organizations have trusted us to help them make strategic workforce decisions through our unified software platform. With more than 800 employees across the US, we are united in our vision and culture to make a difference for our customers, while enjoying the day-to-day.

At QGenda, we value our employees and their contributions toward the success of the business. We strive to create a dynamic work environment that fosters growth, innovation, and collaboration, where employees can be proud of the work they do and the impact it has on the healthcare industry.

As our IT Security Lead at QGenda, you will serve as a senior individual contributor responsible for leading IT security operations, risk management, and governance, risk, and compliance (GRC) initiatives across our IT systems, infrastructure, and SaaS applications. You will identify and reduce risk, strengthen security controls, and mature our GRC program from policy and control design through audit readiness, evidence collection, and remediation.

Working closely with IT and Help Desk, Legal, Product Development, and business teams, you will streamline control management and help ensure alignment with applicable security standards. You will also partner with Product Development’s security team to align enterprise IT security with QGenda’s broader security program.

• Lead IT security operations and advance QGenda’s enterprise IT security strategy and GRC initiatives, translating business objectives and risk priorities into measurable improvements.
• Oversee security controls across QGenda’s IT platforms and assets, including identity, endpoints, SaaS applications, and network infrastructure. Promote secure architecture and configuration, assess control effectiveness and attack surface, address gaps, define security metrics, and report security posture to executive leadership.
• Serve as IT’s primary security subject matter expert (SME), providing daily guidance to IT Systems Administrators and Help Desk teams supporting IT, CRM, and Procurement on secure configuration and control implementation. Partner with system owners to drive remediation.
• Collaborate with IT, Help Desk, and business stakeholders to align security initiatives with business objectives and integrate security into enterprise IT projects, system changes, and operational processes. Coordinate with Product Development’s security team where initiatives overlap.
• Lead the IT vulnerability management program, including regular scans and assessments, risk-based prioritization, timely remediation and patching, and validation of fixes.
• Lead internal and external IT security audits and compliance assessments, including control mapping, evidence coordination, gap analysis, remediation tracking, and audit readiness.
• Improve GRC operations by automating control testing, evidence collection, and compliance workflows, and establishing ongoing monitoring of control status.
• Develop, implement, and maintain IT security policies, standards, and best practices aligned with applicable frameworks, audit requirements, regulations, and customer and contractual obligations including NIST, ISO 27001, SOC 1, SOC 2, SOX, HIPAA, and FedRAMP, as applicable.
• Evaluate security risks associated with internal AI adoption and other new technologies, including configuration, data exposure, vulnerabilities, and potential impacts to existing controls. Recommend appropriate safeguards.
• Coordinate incident preparedness and response with relevant teams, capture lessons learned, and…