Technical Program Manager, Security & Compliance - Heidi

We’re Heidi.

We're building the future of healthcare by giving every clinician the earth's finest AI Care Partner. In just 18 months, our clinical AI products have absorbed the administrative chaos of 73 million patient visits. Today, we support over 2.5 million patient sessions a week across 190+ countries.

Healthcare systems are failing us; clinicians spend more time on documentation than on patients, and the human connection that makes medicine worth practicing is eroding. Our mission is simple: double the world’s healthcare capacity and strengthen the human connection at its heart.

We found product-market fit with a freemium medical scribe that clinicians love. Now, we're expanding. Every task a clinician hands to Heidi is a patient who feels more attended to, a health system unclogged, and a clinician who gets to be a clinician again.

If you don’t choose easy and you want to build something way bigger than yourself then, choose the challenge, choose Heidi.

The role

Heidi operates across US, UK, Australia, beyond and in every market, the same question follows: is this safe, is this secure, and can we prove it? This TPM role is a central platform function: the regulatory and security layer that makes it possible for Heidi to operate inside clinical environments, handle patient data, and be trusted as a medical device.

Clinical AI is under a microscope. Regulators are writing the rules in real time. Every market has its own classification framework, its own submission pathway, its own idea of what a Software as a Medical Device actually is. The difference between a cleared product and a stalled one is often whether someone understood the spec well enough to build against it.

The stack is real and in motion: FDA SaMD classification, TGA registration, MHRA review pathways. ISO 13485 quality management. ISO 14971 risk frameworks. IEC 62304 software lifecycle. SOC 2 Type II. HIPAA. GDPR. The clinical safety standards that let a hospital say yes to deployment. You'll own the regulatory and security roadmap, what to pursue, in what order, and how deep the compliance architecture needs to go. A small dedicated engineering squad sits alongside you. The frameworks are being built. You're picking up a running operation with strong opinions about where it goes.

Your time will be spent translating regulatory reality into product requirements, working directly with legal, engineering, clinical, and commercial to clear the path for enterprise deals. The hard part is that every market moves differently, every hospital has its own security questionnaire, and the gap between what a standard says and what an auditor actually wants can be significant. You'll need to hold the line between one-customer compliance theatre and durable platform-level security architecture.

What you'll do