IT & Cybersecurity Compliance Specialist

Summary

Pearl develops AI solutions for dentistry, including FDA-cleared computer vision for dental imaging. The IT & Cybersecurity Compliance Specialist will administer IT infrastructure while owning cybersecurity and privacy compliance programs involving SOC 2, HIPAA, GDPR, audits, risk assessments, incident response, training, and compliance tooling.

Responsibilities

• Administer and maintain core IT systems including endpoint management, identity and access management (IAM), and SaaS tooling (e.g., Google Workspace, Slack, Notion)
• Manage employee onboarding and offboarding processes including provisioning and deprovisioning of accounts, hardware, and system access
• Maintain and enforce IT access controls, role-based permissions, and the principle of least privilege across all systems
• Serve as the first point of escalation for internal IT support requests and tickets, triaging and resolving technical issues
• Manage and maintain the company’s device fleet, including MDM (Mobile Device Management) enrollment, patching, and compliance monitoring
• Administer and monitor cloud infrastructure and SaaS platform configurations for security and availability
• Maintain IT asset inventory and manage software licensing
• Conduct gap assessments to evaluate compliance with security and privacy regulations (e.g., SOC 2, HIPAA, GDPR)
• Develop, write, and revise Standard Operating Procedures (SOPs) for security and privacy programs
• Implement and monitor security-related Key Performance Indicators (KPIs) to measure and improve compliance performance
• Assess, document, and report security breaches or incidents, ensuring timely and accurate communication
• Perform security assessments of all new and existing suppliers, including annual reviews
• Conduct Information Security incident reviews and recommend corrective actions
• Manage Corrective and Preventive Actions (CAPAs) related to security and privacy
• Prepare for and manage security and privacy audits, ensuring readiness and compliance
• Complete security questionnaires for clients, vendors, and partners
• Stay current on evolving security and privacy regulations and recommend updates to policies and procedures as needed
• Administer and manage the Vanta platform (or equivalent GRC tool) to automate and streamline compliance monitoring and evidence collection
• Oversee the design, delivery, and management of security and privacy training programs for employees
• Design and execute phishing simulation campaigns and related training to enhance employee security awareness
• Host and facilitate recurring security committee meetings and management reviews to align stakeholders on compliance objectives

Skills

• 3+ years of experience in IT administration, systems management, or a combined IT/security role
• 3+ years of experience implementing and maintaining SOC 2 certification
• 3+ years of experience with HIPAA, GDPR, and other global privacy frameworks
• Proven track record of managing compliance programs, including audits, risk assessments, and CAPAs
• Hands-on experience with compliance tools such as Vanta or similar platforms
• Demonstrated experience with endpoint management, IAM platforms, MDM solutions, and SaaS administration
• Strong understanding of cybersecurity best practices, incident response, and supplier risk management
• Excellent written and verbal communication skills, with the ability to translate complex requirements into actionable processes
• Ability to work independently and collaboratively in a fast-paced environment
• Relevant certifications (e.g., CISA, CISM, CISSP, CompTIA Security+, or equivalent) are a plus
• Experience in a SaaS company is strongly preferred
• Experience in a medical device company and/or supporting FDA submissions
• Experience with ISO 27001, ISO 27701, CCPA, or other international security/privacy frameworks
• Background in managing phishing simulation programs and employee training initiatives
• Familiarity with SaaS-specific compliance challenges and customer-facing security requirements
• Experience with Google Workspace administration and IT helpdesk/ticketing workflows
• Comfort operating as a one-person or small-team IT function in a high-growth environment

Qualifications

Must Haves

• 3+ years of experience in IT administration, systems management, or a combined IT/security role
• 3+ years of experience implementing and maintaining SOC 2 certification
• 3+ years of experience with HIPAA, GDPR, and other global privacy frameworks
• Proven track record of managing compliance programs, including audits, risk assessments, and CAPAs
• Hands-on experience with compliance tools such as Vanta or similar platforms
• Demonstrated experience with endpoint management, IAM platforms, MDM solutions, and SaaS administration
• Strong understanding of cybersecurity best practices, incident response, and supplier risk management
• Excellent written and verbal communication skills, with the ability to translate complex requirements into actionable processes
• Ability to work independently and collaboratively in a fast-paced environment

Nice to Haves

• Relevant certifications (e.g., CISA, CISM, CISSP, CompTIA Security+, or equivalent) are a plus
• Experience in a SaaS company is strongly preferred
• Experience in a medical device company and/or supporting FDA submissions
• Experience with ISO 27001, ISO 27701, CCPA, or other international security/privacy frameworks
• Background in managing phishing simulation programs and employee training initiatives
• Familiarity with SaaS-specific compliance challenges and customer-facing security requirements
• Experience with Google Workspace administration and IT helpdesk/ticketing workflows
• Comfort operating as a one-person or small-team IT function in a high-growth environment

Benefits

• Ongoing Training and Development Opportunities
• Unaccrued, Flexible PTO
• Remote Work