Cybersecurity & Compliance Manager

We are seeking an experienced Cybersecurity & Compliance
Manager to lead the protection of our digital infrastructure, patient-facing platforms, and highly sensitive behavioral health information.

This leader will oversee enterprise cybersecurity strategy, cloud security governance, risk management, and regulatory compliance across a multi-state behavioral healthcare environment. The Director will partner closely with Technology, Clinical, Operations, executive leadership, and the Chief Compliance and Privacy Officer to ensure our systems, patient information, and business operations remain secure, scalable, resilient, and compliant.

• Develop and execute a company-wide cybersecurity strategy designed to protect highly sensitive behavioral health information, patient-facing platforms, provider systems, and virtual care environments.
• Architect and maintain the security and compliance roadmap across AWS, Microsoft Azure, and Microsoft 365 environments.
• Develop, maintain, and continuously improve cybersecurity policies, standards, and governance documentation, including Incident Response Plans, Breach Notification procedures, System Security Plans (SSPs), and related security and compliance documentation.
• Establish and report meaningful cybersecurity metrics and key risk indicators (KRIs), including risk trends, remediation progress, security posture, and compliance readiness.
• Translate complex cybersecurity, cloud, and compliance risks into clear, actionable business recommendations for executive leadership and board-level stakeholders, as appropriate.

• Lead cybersecurity compliance efforts related to HIPAA, HITECH, SOC 2, HITRUST, NIST, and other applicable federal and state healthcare privacy and security requirements.
• Ensure cybersecurity and compliance practices appropriately support the organization's multi-state healthcare operations, including applicable state-specific healthcare privacy and security requirements.
• Maintain appropriate safeguards for sensitive behavioral health information, including patient records, psychotherapy-related information, intake documentation, provider information, and other protected health information.
• Conduct or manage HIPAA Security Rule risk analyses, including asset identification and inventory, business associate management, Business Associate Agreements (BAAs), risk assessment, remediation, and ongoing monitoring.
• Maintain the enterprise cloud/IT risk registry and oversee risk identification, prioritization, remediation, and reporting.
• Lead and coordinate external cybersecurity and compliance audits and maintain ongoing organizational audit readiness.
• Ensure applicable security policies and controls are appropriately mapped to regulatory and compliance requirements.
• Provide cybersecurity governance across Amazon Web Services (AWS), Microsoft Azure, and Microsoft 365 environments.
• Implement and oversee identity and access management (IAM), encryption, data loss prevention (DLP), configuration controls, and other safeguards protecting sensitive patient, provider, and organizational information.
• Ensure appropriate security controls are maintained across psychiatric EHR systems, patient portals, intake systems, provider platforms, telehealth environments, and other patient-facing applications.
• Leverage cloud-native technologies such as AWS Audit Manager and Microsoft Purview to support continuous compliance and move beyond point-in-time audit readiness.
• Monitor cloud configurations, access controls, DLP controls, and IAM policy enforcement to identify and remediate security risks.

• Oversee regular vulnerability assessments, security…