About the role
Compliance Pro is a HIPAA-regulated SaaS for home-care, 245D, mental health (ARMHS) and assisted living agencies. It covers caregiver onboarding, e-signatures, training, client intake, EVV, Medicaid billing and compliance. We’re in production on AWS with agencies onboarding now. Much of our development is done by AI coding agents under a defined process. We need an experienced technical leader to oversee architecture, security and releases, and to be our accountable human engineering lead.
What you’ll do (about 5–10 hours a week to start, flexible)
Review and approve architecture, pull requests and releases, and set engineering standards and guardrails for AI-assisted development.
Own security and HIPAA technical safeguards: access control, encryption, audit logging, incident response, backup and restore testing, and vendor BAAs.
Lead SOC 2 readiness: choose a compliance platform and auditor, and coordinate a third-party penetration test.
Oversee AWS infrastructure in Terraform (ECS Fargate, CloudFront and WAF, DocumentDB, S3, Secrets Manager, KMS, Bedrock) and approve infrastructure changes.
Guide Medicaid integrations: X12 837P, 835, 270/271 and 276/277 through a clearinghouse; state EVV aggregators (Sandata, Netsmart, HHAeXchange); and trading partner setup.
Monitoring, on-call escalation and uptime. Join a monthly roadmap review with the founder.
Must have
8+ years in software engineering, including 3+ in a CTO, VP Engineering or principal role.
Hands-on HIPAA experience in production (BAAs, PHI handling, audits).
AWS production experience; Terraform.
Python (FastAPI or similar) and React; MongoDB or DocumentDB.
Experience leading a SOC 2 Type II or HITRUST effort.
Strong plus
Healthcare EDI (X12) and clearinghouses; Medicaid or home-care / HCBS domain.
EVV programs and state Medicaid systems (ND, MT, MI, MN, ME).
Overseeing AI-assisted or agent-based development workflows.
Mobile (React Native / Expo).
How we work
Remote, U.S.-based. You’ll sign an NDA and a BAA before access.
Least-privilege access; no PHI outside our systems.
Start with a paid 2-week assessment: an architecture and security review with a prioritized plan. Then ongoing monthly.
To apply, please answer:
Describe a HIPAA system you were responsible for, and how you handled audits.
What’s your SOC 2 experience, and how long did readiness take?
What experience do you have with X12/EDI or EVV, if any?
What’s your hourly rate and weekly availability?