First Security Engineer - Build HITRUST Program

This is a high-impact, high-autonomy founding security role at an early-stage healthcare tech company — a genuinely rare opportunity to build a compliance program from near-scratch rather than inheriting someone else's tech debt. Reporting directly to the Head of Engineering with no security team above or below you signals broad scope and real ownership.

Compensation analysis: $140K–$175K is competitive for a mid-to-senior security engineer in the US, though slightly below what FAANG or large healthtech firms pay for equivalent HITRUST/SOC 2 expertise (often $180K–$220K+). The equity component partially offsets this, and the public benefit corporation structure may appeal to mission-driven candidates.

• End-to-end HITRUST r2 certification ownership — one of the most valued credentials in health IT compliance
• AI governance and LLM data access controls — a rapidly growing, high-demand specialization
• GCP cloud security architecture review and IAM policy auditing
• Customer-facing security communication — valuable for future CISO or VP-Security trajectories

Green flags: Flat structure, clear success metrics (certifications), early-stage equity, mission-driven mission, and the ability to shape the entire security culture.

Watch for: No defined growth ladder ("no levels") means promotion is informal — you'll need to self-advocate. As the sole security hire, burnout risk is real during certification crunch periods. Ensure the equity terms and vesting schedule are clearly negotiated before accepting.

Aradigm is a public benefit corporation helping people with cancer and other serious diseases access life-changing cell and gene therapies that can potentially cure them. We do this through a new coverage model for self-insured employers and health plans, and our customers trust us with their members' sensitive health data.

We're hiring our first Security Engineer — one of the first engineering hires after our Head of Engineering — to own security and compliance across the company. You'll own our HITRUST r2 and SOC 2 Type 2 programs and be the person customers and partners talk to when they want to know how we protect their data. This is a hands-on role: you'll write the policy, implement the control, collect the evidence, and answer the questionnaire.

You'll report to our Head of Engineering and work closely with our engineering and data teams, legal counsel, and an external IT partner. There's no security department to inherit, and we're a flat organization with no levels: you grow here by taking on more scope and owning outcomes. We work remotely within the US, with a strong preference for the East Coast and travel to our NYC office 3–5 times a year.

Success in this role means obtaining and maintaining our HITRUST r2 and SOC 2 Type 2 certifications.

You won't do it alone. Your first six months focus on honing our processes and procedures, with our assessor, an external penetration testing team, and other security vendors helping you move faster.

• Own HITRUST and SOC 2: lead our HITRUST r2 and SOC 2 Type 2 programs, including expanding HITRUST scope over time, and run the evidence, control testing, and remediation that keep both current year-round
• Own customer security reviews: answer security questionnaires, diligence requests, and audit asks from employers, health plans, and carriers; turn repeat questions into reusable, accurate answers
• Guide secure engineering: review security designs for new systems, audit our existing cloud (GCP) implementation, and give engineers clear, practical feedback rather than gatekeeping
• Run data loss prevention and AI governance: operate our DLP tooling and the…