About the role
Parachute Health is transforming post-acute care as the leading digital ordering platform for medical equipment and supplies. We connect major health systems, health plans, and suppliers to help patients get the life-saving products they need at home. Since launching, we've connected 300,000+ clinicians and 3,000+ supplier locations across all 50 states and helped 15M+ patients. What started as a DME ePrescribing tool has become the order management platform of choice for home medical equipment. Join our team and make a difference in patient care.
About
the Role This is a hybrid role: roughly half security compliance and audit, half hands-on technical security. You'll own our compliance audit cycle end-to-end (SOC 1, SOC 2, HITRUST CSF, HITRUST AI), and you'll also work directly on the technical side: vulnerability management, security findings remediation, cloud security reviews, and third-party risk.
Responsibilities Compliance & Audi t Own SOC 1, SOC 2, HITRUST CSF, and HITRUST AI audits end-to-end: scoping, evidence collection, auditor coordination, and findings remediation Develop, update, revise, and implement compliance policies, procedures, and practices for security frameworks (HIPAA, HITRUST, SOC) as well as general compliance and operations Manage our compliance automation and trust platforms (Drata, SafeBase), including control monitoring and responses to customer security questionnaires. Coordinate with external vendors and clients to gather information needed for compliance reviews, validations, and audits Run third-party/vendor risk assessments and respond to customer security assessments and external inquiries Deliver HIPAA and security awareness training and measure control effectiveness through internal audits Technical Security Run the vulnerability management program: scanning, triage, prioritization, and driving remediation with engineering teams Investigate and remediate security findings across our AWS environment (EKS, WAF, Shield, CloudFront, IAM) and SaaS stack Review external attack surface findings (e.g., SecurityScorecard) and implement fixes from CSP headers to subresource integrity to TLS configuration Support security incident response: log analysis, forensic evidence collection, and containment Support fraud and forensic investigations authentication log analysis, targeted data extraction, and evidence preservation in support of legal and compliance matters Improve our security tooling and automate evidence collection, using scripting (Python, Bash) where manual work can be eliminated