Fractional Compliance Manager (Healthcare AI, SOC2, HITRUST)

We're a healthcare technology company that handles regulated health data and runs an active compliance program on Vanta. We're looking for a hands-on fractional compliance manager to own the day-to-day and keep our certifications audit-ready. This is an execution role, not an advisory one. Scope of work: - Maintain a SOC 2 Type 2 program in Vanta: evidence collection, access reviews, control monitoring, and remediation of failing tests. - Support a HITRUST e1 recertification later this year: screenshots, access reviews, and policy refreshes. - Administer security policies and required training end to end: distribution, acceptance tracking, and completion reporting, including HIPAA-related modules. - Track vendor and BAA obligations and flag gaps against our standards. - Provide a clear, current read on open gaps and audit risk. What we're looking for: - Direct, hands-on GRC experience in a US healthcare / HIPAA environment. - A track record maintaining SOC 2 Type 2 and delivering HITRUST e1 (renewal experience preferred). - Fluent in Vanta - Someone who runs with access and gets it done with light oversight, rather than producing recommendations for others to execute. - Remote, with meaningful overlap with East Coast business hours. Terms: hourly, roughly 10 hours per month to start, with some flexibility up or down.