Healthcare Security Lead (HIPAA)

Role: Healthcare Security Lead (HIPAA)

Location: Gachibowli, Hyderabad.

Type: Full-time Onsite
Shifts: Night Shifts: 07:30pm – 04:30am IST

Reports to: Enterprise Transformation Lead

Responsibilities:

• Lead the first-30-day controls: device inventory, MFA on email, remote access and admin accounts, removal of stale admins and leaver accounts.
• Define the standard HIPAA-hardened laptop build (encryption, patching, endpoint protection, device management, no local admin) and sign off its rollout.
• Map every control to the HIPAA Security Rule (access control, audit, integrity, transmission security) and keep the evidence audit ready.
• Work with the cyber insurance broker on exact control wording and deadlines; prepare for and run the independent assessment.
• Review vendor access to patient data: BAAs, data held, encryption, offboarding with destruction certificates.
• Approve patient-data flows on new platforms (contact center, CRM-to-EHR integrations) before they go live.
• Write and maintain the security policies, incident response plan and risk register.

Mandatory Skills:

• 8+ years in information security, 3+ in healthcare or another HIPAA-regulated setting.
• Hands-on remediation experience: you have personally moved a security posture score, audited one.
• Working depth in Microsoft 365 security: Entra ID, Conditional Access, Intune, Defender or a third-party EDR.
• Experience with HIPAA risk assessments and frameworks such as NIST CSF, HITRUST or CIS Controls.
• Has led or coordinated a small security team and external vendors.
• Plain-English writing for executives and board readouts.

Nice to have

• CISSP, CISM, HCISPP or Security+; multi-site or PE-backed healthcare environments; cyber insurance questionnaires.
• MFA live on the insurer's scope, every device inventoried, the laptop image piloted, and the assessed score at target by Week 9.