Senior Security Engineer

Solace is a healthcare advocacy marketplace that connects patients and families to experts who help them understand and take charge of their personal health

About The Role

We're looking for a Senior Security Engineer to join our security team as our second security hire. You'll play a foundational role in building and scaling our corporate security program, security operations, and governance functions as we rapidly grow from 200 to 400+ employees.

This is a high-impact role where you'll own critical security and compliance initiatives across the organization. You'll work directly with IT, HR, Legal, and leadership teams to build robust security controls, drive awareness, and establish a security-first culture while maintaining the agility a Series B startup requires.

About Solace 🔥

Healthcare in the U.S. is fundamentally broken. The system is so complex that 88% of U.S. adults do not have the health literacy necessary to navigate it without help. Solace cuts through the red tape of healthcare by pairing patients with expert advocates and giving them the tools to make better decisions—and get better outcomes.

We're a Series B startup, founded in 2022 and backed by Inspired Capital, Craft Ventures, Torch Capital, Menlo Ventures, and Signalfire. Our fully remote U.S. team is lean, mission-driven, and growing quickly.

Solace isn't a place to coast. We're here to redefine healthcare—and that demands urgency, precision, and heart. If you're looking to stretch yourself, sharpen your edge, and do the best work of your life alongside a team that cares deeply, you're in the right place. We’re intense, and we like it that way.

Read more in our Wall Street Journal funding announcement here.

What You'll Do

Identity & Access Management (Primary Focus)

• Manage and optimize Okta SSO deployment across 70+ SaaS applications
• Implement and enforce role-based access controls (RBAC) and least privilege principles
• Lead quarterly access reviews and user lifecycle management
• Drive adoption of MFA and implement conditional access policies
• Oversee endpoint management via Jamf and device compliance standards
  
  

Security Governance & Compliance

• Drive HIPAA and SOC 2 compliance maintenance through Vanta
• Manage vendor risk assessment program and Business Associate Agreement (BAA) collection for 70+ vendors
• Develop and maintain security policies, standards, and procedures
• Support customer security assessments and RFP responses
• Prepare for HITRUST certification and future IPO readiness requirements
  
  

Security Awareness & Training

• Design and deliver security awareness training
• Create role-specific training programs (HIPAA, phishing, data handling, incident response)
• Build and maintain security documentation and knowledge base
• Develop metrics and reporting on training completion and effectiveness
• Partner with HR on security onboarding and offboarding processes
  
  

Security Operations & Monitoring

• Implement and tune security monitoring and alerting systems
• Manage security logging and audit trail requirements for HIPAA compliance
• Conduct security assessments and risk analysis
• Lead incident response coordination and post-incident reviews
• Track and remediate security findings from audits and assessments
  
  

Risk Management & Third-Party Security

• Maintain risk register and coordinate risk treatment activities
• Conduct vendor security assessments and ongoing monitoring
• Support procurement reviews for security and compliance implications
• Manage security aspects of contractor access and data handling
  
  

What You Bring To The Table

• 4+ years in corporate security, GRC, security operations, or similar roles
• Hands-on experience with identity and access management (Okta, Azure AD, or similar IAM platforms)
• Practical HIPAA implementation experience in healthcare or regulated environments
• Experience building security awareness programs and delivering training to diverse audiences
• Demonstrated success implementing security controls in cloud-first organizations
• Familiarity with compliance frameworks (SOC 2, HIPAA, HITRUST) and audit processes
• Experience with endpoint management solutions (Jamf, Intune, or similar)
• Security certifications (CISSP, CISM, CISA, Security+, or similar)
• Experience with GRC platforms (Vanta, Drata, SecureFrame)
• Background in IT systems administration or helpdesk
• Experience managing security for remote/distributed workforces
• Familiarity with vendor risk management platforms
• Knowledge of data privacy regulations (GDPR, CCPA)
• Ability to collaborate and balance security rigor with business enablement
  
  

Applicants must be based in the United States.

Up for the Challenge?

We look forward to meeting you.

Fraudulent Recruitment Advisory: Solace Health will NEVER request bank details or offer employment without an interview. All legitimate communications come from official solace.health emails only or ashbyhq.com. Report suspicious activity to [email protected] or [email protected].