Security & Compliance Analyst, Headspace Health

• 3+ years of experience in a security, compliance, privacy, or risk-related role
• Bachelor’s degree in a related field (e.g., Information Security, Information Technology, Computer Science, etc. ) or equivalent practical experience in a security, compliance, or privacy-related role
• Foundational understanding of security, privacy, and compliance frameworks (e.g., SOC 2, HITRUST, HIPAA, ISO 27001 and NIST)
• Strong organizational and project management skills, with the ability to track multiple deadlines across audits, vendor reviews, and cross-functional initiatives
• Excellent written and verbal communication skills, especially in translating technical or policy-heavy material for varied audiences
• Comfortable working with SaaS tools such as Jira, Confluence, Google Workspace, and other GRC or project tracking systems
• Curiosity and initiative in learning security and risk concepts, with a growth mindset toward more technical domains

Desirable

• At Headspace, we're pushing boundaries with cutting-edge innovations and a relentless focus on reliability, scalability, and purpose-driven impact
• As a Security & Compliance Analyst, you'll help lead the charge in refining our risk & security programs, driving compliance excellence, and ensuring our product, applications, and infrastructure are secured to improve Headspace’s overall security posture
• Join us in transforming the way we approach risk and security while advancing your career in a dynamic and meaningful environment where your expertise truly makes a difference
• You will support our efforts to bring innovative features to life, leverage cutting-edge technologies, and ensure our platform's reliability and scalability for over 65 million users
• A big goal needs talented leadership, so come join us and give your career a sense of purpose!
• Own and provide oversight of programs across security, risk, compliance, and privacy at Headspace, helping implement and test controls in numerous security domains
• Lead day-to-day coordination of external audits, including HITRUST, SOC 2, and Cyber Essentials+, by gathering evidence, managing stakeholders, and tracking remediation plans to completion
• Triage, track, and respond to B2B customer security questionnaires, ensuring timely, accurate, and scalable delivery of assurance documentation while implementing on-going automation efforts
• Maintain and monitor the vendor risk management program, including onboarding reviews, risk assessments, reassessments, and supporting documentation workflows
• Partner with Product, Engineering, Legal, and IT teams to help conduct security reviews and embed privacy and compliance into the product development lifecycle
• Maintain security policies and procedures, ensuring they align with internal processes, audit frameworks, and regulatory requirements
• Support continuous improvement initiatives across GRC tooling, automation, and metrics/reporting infrastructure