RethinkFirst
About Rethink First
Rethink First is a leading behavioral health technology company working to make mental wellness, education, and support accessible and scalable. Through our suite of cloud-based platforms—including RethinkEd, RethinkCare, and RethinkBH—we serve educators, employers, and providers with tools that deliver measurable, inclusive outcomes.
About The Role We are building a modern, cloud-forward security program grounded in Cyber Resilience, Application Security, and Security Assurance. As our Manager, Information Security, you will be the operational and execution leader for our Security Assurance function while helping shape key processes across SecOps and AppSec.
This role is ideal for someone who thrives in a high-growth SaaS environment, collaborates well cross-functionally, and wants to help mature a security program that must support HIPAA, SOC 2 Type II, HITRUST, and a broad healthcare customer base.
You will own the day-to-day execution of GRC, Audit Readiness, Evidence Collection, Policy Management, TPRM, and Client Trust—and must have hands‑on experience implementing or operating Vanta as a centralized compliance automation platform.
You will serve as a multiplier for the Sr Director, creating repeatable processes, driving deadlines, maturing documentation, and ensuring audit-ready control operation across Azure, M365, and our SaaS product ecosystem.
Key Responsibilities
Lead the end-to-end Security Assurance function across SOC 2, HIPAA, HITRUST, and regulatory frameworks
Act as the program manager for all audits, coordinating with Legal, HR, Engineering, Product, and Infrastructure to maintain year-round audit readiness
Own the implementation, configuration, optimization, and continuous operation of Vanta, including:
Control mapping and ownership assignments
Evidence collection workflows
Vendor risk management modules
Client Trust functionality (best answers, trust portal, knowledge base)
Build and maintain an audit calendar, evidence repository, and standardized evidence collection playbooks
Drive development and continuous maintenance of security policies, standards, and procedures
Operate the Third-Party Risk Management process, including vendor classification (Tier 1/BAA), questionnaire review, residual risk scoring, and contract security review
Respond to customer security questionnaires, RFPs, and client audit requests with clarity, accuracy, and speed
Cyber Resilience & SecOps Leadership
While not a hands‑on SecOps role, you will:
Partner with the SecOps Engineers to build daily operational cadence across alerts, incidents, vulnerability management, and hygiene controls
Ensure controls monitored by Tenable, Microsoft Defender, Sentinel, and other platforms produce audit-ready evidence
Help design operational dashboards and KPIs for incident response, vulnerability SLAs, and hygiene metrics
Validate operational controls for compliance frameworks (MFA, SSO, logging, monitoring, access reviews, backups, endpoint security, network protections, etc.)
Application Security Collaboration
Work with Engineering, Architecture, and DevOps teams to ensure Product and AppSec controls align with SOC 2 and HITRUST expectations
Contribute to secure SDLC processes, risk assessments for new features, and remediation tracking for vulnerabilities and findings
Validate that security requirements are integrated into CI/CD workflows where appropriate
Required Qualifications
7+ years of progressive experience in Information Security, with at least 3+ years in a governance, compliance, or Security Assurance leadership role
Direct experience implementing or operating Vanta (must be hands‑on)
Strong experience supporting and maturing SOC 2 Type II, HIPAA Security Rule, and HITRUST programs in a SaaS environment
Deep understanding of Microsoft Azure security architecture, including Entra ID, RBAC, Conditional Access, Defender for Cloud, Sentinel, and workload identities
Clear understanding of audit control design, evidence, and auditor expectations
Experience building vendor risk programs, reviewing DPAs and BAAs, and performing vendor due diligence
Excellent writing skills for policies, procedures, client responses, and audit documentation
Demonstrated ability to lead complex projects with multiple stakeholders and tight deadlines
Strong communication and relationship-building skills across technical and non‑technical teams
Preferred Qualifications
Experience in healthcare SaaS or other regulated industries
Hands‑on experience with:
Vanta Vendor Risk + Trust Center
Microsoft Purview (DLP, Information Protection)
Azure DevOps or GitHub governance
Tenable, Defender, or other vulnerability platforms
Jira/Confluence
Certifications such as CISA, CISSP, HCISPP, HITRUST CCSFP, or similar
Experience working with offshore teams
Benefits
Generous health, dental, & vision benefits package
Flexible paid time off
11 paid company holidays
401k + matching
Parental leave
Access to our award‑winning RethinkCare platform supporting neurodiversity in the workplace through parental success, professional resilience, and personal wellbeing.
Location Remote opportunities are available to candidates who reside in the following states: AL, AZ, CT, FL, GA, HI, IA, IL, IN, KY, LA, MD, MA, MI, MN, MO, MT, NC, NE, NH, NJ, NV, OH, OR, PA, RI, TN, TX, VA, WA, WI, WY.
Our commitment to an inclusive workplace RethinkFirst is an equal opportunity employer and is committed to providing a workplace free from harassment and discrimination. We celebrate the unique differences of our employees because that is what drives curiosity, innovation, and the success of our business. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, status as a protected veteran, or any other protected category under applicable federal, state, and local laws. Accommodations are available for applicants with disabilities.
#J-18808-Ljbffr
About The Role We are building a modern, cloud-forward security program grounded in Cyber Resilience, Application Security, and Security Assurance. As our Manager, Information Security, you will be the operational and execution leader for our Security Assurance function while helping shape key processes across SecOps and AppSec.
This role is ideal for someone who thrives in a high-growth SaaS environment, collaborates well cross-functionally, and wants to help mature a security program that must support HIPAA, SOC 2 Type II, HITRUST, and a broad healthcare customer base.
You will own the day-to-day execution of GRC, Audit Readiness, Evidence Collection, Policy Management, TPRM, and Client Trust—and must have hands‑on experience implementing or operating Vanta as a centralized compliance automation platform.
You will serve as a multiplier for the Sr Director, creating repeatable processes, driving deadlines, maturing documentation, and ensuring audit-ready control operation across Azure, M365, and our SaaS product ecosystem.
Key Responsibilities
Lead the end-to-end Security Assurance function across SOC 2, HIPAA, HITRUST, and regulatory frameworks
Act as the program manager for all audits, coordinating with Legal, HR, Engineering, Product, and Infrastructure to maintain year-round audit readiness
Own the implementation, configuration, optimization, and continuous operation of Vanta, including:
Control mapping and ownership assignments
Evidence collection workflows
Vendor risk management modules
Client Trust functionality (best answers, trust portal, knowledge base)
Build and maintain an audit calendar, evidence repository, and standardized evidence collection playbooks
Drive development and continuous maintenance of security policies, standards, and procedures
Operate the Third-Party Risk Management process, including vendor classification (Tier 1/BAA), questionnaire review, residual risk scoring, and contract security review
Respond to customer security questionnaires, RFPs, and client audit requests with clarity, accuracy, and speed
Cyber Resilience & SecOps Leadership
While not a hands‑on SecOps role, you will:
Partner with the SecOps Engineers to build daily operational cadence across alerts, incidents, vulnerability management, and hygiene controls
Ensure controls monitored by Tenable, Microsoft Defender, Sentinel, and other platforms produce audit-ready evidence
Help design operational dashboards and KPIs for incident response, vulnerability SLAs, and hygiene metrics
Validate operational controls for compliance frameworks (MFA, SSO, logging, monitoring, access reviews, backups, endpoint security, network protections, etc.)
Application Security Collaboration
Work with Engineering, Architecture, and DevOps teams to ensure Product and AppSec controls align with SOC 2 and HITRUST expectations
Contribute to secure SDLC processes, risk assessments for new features, and remediation tracking for vulnerabilities and findings
Validate that security requirements are integrated into CI/CD workflows where appropriate
Required Qualifications
7+ years of progressive experience in Information Security, with at least 3+ years in a governance, compliance, or Security Assurance leadership role
Direct experience implementing or operating Vanta (must be hands‑on)
Strong experience supporting and maturing SOC 2 Type II, HIPAA Security Rule, and HITRUST programs in a SaaS environment
Deep understanding of Microsoft Azure security architecture, including Entra ID, RBAC, Conditional Access, Defender for Cloud, Sentinel, and workload identities
Clear understanding of audit control design, evidence, and auditor expectations
Experience building vendor risk programs, reviewing DPAs and BAAs, and performing vendor due diligence
Excellent writing skills for policies, procedures, client responses, and audit documentation
Demonstrated ability to lead complex projects with multiple stakeholders and tight deadlines
Strong communication and relationship-building skills across technical and non‑technical teams
Preferred Qualifications
Experience in healthcare SaaS or other regulated industries
Hands‑on experience with:
Vanta Vendor Risk + Trust Center
Microsoft Purview (DLP, Information Protection)
Azure DevOps or GitHub governance
Tenable, Defender, or other vulnerability platforms
Jira/Confluence
Certifications such as CISA, CISSP, HCISPP, HITRUST CCSFP, or similar
Experience working with offshore teams
Benefits
Generous health, dental, & vision benefits package
Flexible paid time off
11 paid company holidays
401k + matching
Parental leave
Access to our award‑winning RethinkCare platform supporting neurodiversity in the workplace through parental success, professional resilience, and personal wellbeing.
Location Remote opportunities are available to candidates who reside in the following states: AL, AZ, CT, FL, GA, HI, IA, IL, IN, KY, LA, MD, MA, MI, MN, MO, MT, NC, NE, NH, NJ, NV, OH, OR, PA, RI, TN, TX, VA, WA, WI, WY.
Our commitment to an inclusive workplace RethinkFirst is an equal opportunity employer and is committed to providing a workplace free from harassment and discrimination. We celebrate the unique differences of our employees because that is what drives curiosity, innovation, and the success of our business. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, status as a protected veteran, or any other protected category under applicable federal, state, and local laws. Accommodations are available for applicants with disabilities.
#J-18808-Ljbffr