Role: Healthcare Security Lead (HIPAA)
Location: Gachibowli, Hyderabad.
Type: Full-time Onsite
Shifts: Night Shifts: 07:30pm – 04:30am IST
Reports to: Enterprise Transformation Lead
Responsibilities:
- Lead the first-30-day controls: device inventory, MFA on email, remote access and admin accounts, removal of stale admins and leaver accounts.
- Define the standard HIPAA-hardened laptop build (encryption, patching, endpoint protection, device management, no local admin) and sign off its rollout.
- Map every control to the HIPAA Security Rule (access control, audit, integrity, transmission security) and keep the evidence audit ready.
- Work with the cyber insurance broker on exact control wording and deadlines; prepare for and run the independent assessment.
- Review vendor access to patient data: BAAs, data held, encryption, offboarding with destruction certificates.
- Approve patient-data flows on new platforms (contact center, CRM-to-EHR integrations) before they go live.
- Write and maintain the security policies, incident response plan and risk register.
Mandatory Skills:
- 8+ years in information security, 3+ in healthcare or another HIPAA-regulated setting.
- Hands-on remediation experience: you have personally moved a security posture score, audited one.
- Working depth in Microsoft 365 security: Entra ID, Conditional Access, Intune, Defender or a third-party EDR.
- Experience with HIPAA risk assessments and frameworks such as NIST CSF, HITRUST or CIS Controls.
- Has led or coordinated a small security team and external vendors.
- Plain-English writing for executives and board readouts.
Nice to have
- CISSP, CISM, HCISPP or Security+; multi-site or PE-backed healthcare environments; cyber insurance questionnaires.
- MFA live on the insurer's scope, every device inventoried, the laptop image piloted, and the assessed score at target by Week 9.
