Location: Remote - India
Type: Full-time
Working Hours: All meetings and live collaboration happen between approximately 6:00 PM and 12:00 AM IST , overlapping US Pacific Time. Attendance in that window is required. Your remaining work is yours to schedule.
Commitment: Approximately 50 hours per week
Industry: Healthcare technology experience is preferred but not mandatory
Zenara Health is a technology-oriented mental healthcare organization building clinical software for behavioral-health clinics. We work with sensitive patient data, so security, access control, vendor risk, AI-tool risk, and evidence of how our controls operate are fundamental to earning customer trust.
We are a startup, not a department. We move quickly and need a security and compliance program that is rigorous enough for healthcare and practical enough to work in a small, fast-moving company.
We are looking for a Senior Security & Compliance Lead to build and own Zenara’s security and compliance program.
You will set risk priorities, define security and HIPAA-related controls, verify that they work, and lead our responses to customer security reviews. You will work closely with the Head of Engineering and our Platform Engineer, who owns day-to-day platform operations and implements and operates many of the technical controls.
You own the program’s direction and outcomes. The Platform Engineer owns the day-to-day operation of the platform. You will work together to turn security requirements into working practices, not just documents.
Here is the test: can you inspect a real technical environment, identify the risks that matter most, explain the trade-offs, and work with engineers to implement and verify effective controls?
We are not looking for someone who only produces compliance paperwork. We need a leader with healthcare security judgment, technical depth, and the willingness to remain involved until a control actually works.
Security and compliance should be part of how Zenara operates every day—not a last-minute exercise when a customer sends a questionnaire.
You will build a program with clear control owners, practical policies, current evidence, tracked remediation, and tested response procedures. It should give engineering a safe path to move quickly while helping us protect patient data and answer customer questions with confidence.
Your remit includes:
The goal is not to create the largest possible program. It is to establish the right controls, make ownership clear, and ensure those controls keep working as Zenara grows.
These are closely connected roles, but they do not have identical ownership.
You will own: security and compliance strategy, risk decisions, control standards, HIPAA-related program requirements, verification, vendor and AI-tool risk reviews, and customer security responses.
The Platform Engineer will own: day-to-day infrastructure operations, deployments, monitoring, backups and restores, technical implementation of platform controls, and recurring operational checks.
For example, you may define the access-control standard and how its effectiveness will be verified. The Platform Engineer may implement it in Azure and operate the recurring checks. You will review the evidence, address exceptions, and remain accountable for whether the standard is adequate.
Our engineering team uses AI agents to help build and operate software. That creates opportunities to improve speed and consistency, as well as risks that conventional security processes may miss.
You will help define:
You do not need to be the person building every agent. You do need the judgment to govern their use and verify that automated checks are reliable. AI can assist with security work; it does not take accountability for security decisions.
In your first 30 days, you will review our current environment with the Platform Engineer, identify the highest-priority security and compliance gaps, clarify control ownership, and establish a practical remediation plan.
Within 90 days, core HIPAA-related policies and controls will have assigned owners and supporting evidence. Priority findings will be tracked to resolution, and the team will have a working cadence for reviewing risks, control effectiveness, and customer security requests.
Over time, Zenara will have a maintained security and compliance program: current evidence, tested incident procedures, tracked exceptions, clear ownership, and the ability to respond confidently to customer security reviews. Success means we can demonstrate how controls work in practice—not merely point to documents saying they exist.
This is a full-time, remote role requiring regular live collaboration with our US-based founder and India-based engineering team. India-evening overlap is expected; the specific hours will be confirmed during hiring.
Significant security incidents may occasionally require coordination outside the usual collaboration window.
This role is well suited to someone who:
You may struggle if you prefer to advise from a distance, produce generic documentation without verifying implementation, or need a large established security team and budget to make progress.
If you want to own the security and compliance program for an AI-native health-tech company—and build foundations that work in practice—we would love to hear from you.
