Manager, Technology Risk

About the role

The Technology Risk Manager is a senior individual contributor responsible for driving Hinge Health's technology risk posture across security, infrastructure, and IT. You will act as the primary owner for technology risk across multiple teams rather than as a pure advisor. The role provides broad exposure to Security, IT, and Engineering leadership, and you are expected to confidently surface risks, drive clear risk evaluations, and collaborate with partners to land practical remediation decisions. You will operate within a PHI-handling and heavily regulated environment where risk decisions directly impact patient data and regulatory standing. This position requires a high degree of ownership, judgment, and follow-through to ensure the technology risk landscape is understood, managed, and continuously improved.

Key facts

What you'll do

• Maintain and continuously refine the Technology Risk Register, documenting cyber, operational, and regulatory risks with clear ratings, owners, and mitigation plans.
• Track and drive remediation progress across engineering and IT teams, escalating and unblocking as needed to ensure risk treatment plans meet agreed SLAs.
• Serve as the primary interface for internal and external auditors on SOX IT General Controls (ITGC) and related technology control testing, documentation, and evidence collection.
• Coordinate and track remediation of SOX ITGC findings, ensuring clear ownership, high-quality corrective actions, and timely closure to prevent control deficiencies and material weaknesses.
• Partner with Security, Accounting, Legal/Compliance, and IT to ensure risk and control practices support HIPAA and other healthcare regulatory requirements.
• Partner with Application Security, SRE, and Infrastructure teams to aggregate, prioritize, and track code vulnerabilities, penetration-testing findings, and infrastructure risks across the SDLC.
• Analyze vulnerability trends by system, control, and data sensitivity to help teams focus on the highest-impact remediation work.
• Drive consistent, high-quality documentation of risk decisions, mitigations, and compensating controls.
• Design and maintain risk and control dashboards that provide senior leadership with clear insight into security posture, compliance status, and remediation velocity.
• Produce recurring executive-ready reports and narratives that translate complex technical risk into clear, non-technical language for decision-makers and risk committees.
• Recommend and refine KPIs and KRIs that measure technology risk, SOX ITGC health, and vulnerability reduction over time.
• Collaborate with product and engineering teams to embed risk considerations into delivery roadmaps and release planning.
• Support incident response and post-incident reviews by assessing technology risk implications and recommending control improvements.
• Contribute to the development and maintenance of policies, standards, and playbooks that codify technology risk management practices.

Requirements

• 2+ years of experience in technology risk, IT audit, cybersecurity, or information security, with recent, hands-on in SOX-driven or heavily regulated environments (e.g. public/pre-IPO, company, Big 4 IT audit/risk advisory, financial services or healthcare).
• Proven track record as a senior IC leading complex, cross-functional risk or compliance programs with high visibility to engineering and IT leadership.
• Deep experience with SOX IT General Controls (design, testing, and remediation) in cloud-first environments.
• Strong understanding of access management, change management, computer operations, and related control frameworks.
• Comfort working in PHI-handling or similarly sensitive data environments.
• Demonstrated ability to influence senior engineering and IT stakeholders: you can surface uncomfortable risks, keep discussions anchored in facts and impact, and help teams arrive at well-documented decisions.
• Excellent relationship-builder who balances assertiveness with partnership - able to challenge, negotiate trade-offs, and still maintain trust.
• Exceptional written and verbal communication skills; you distill complex technical risk into concise, executive-ready narratives and clear action plans.

Nice to have

• Certifications such as CISA, CISSP, or equivalent.
• Prior Big 4 (or similar) experience in IT audit, SOX, or technology risk.
• Experience with SOX IT General Controls and broader security frameworks.

Practical notes

• This is a hybrid role based in the San Francisco office, requiring in-person attendance three days per week for a full 8-hour business day.
• On remote days, employees are expected to work during core business hours with flexibility.
• The office is part of a dog-friendly workplace program, and while travel is not regularly required, occasional off-site/on-site events may occur.
• Physical demands are minimal and primarily involve standard office activities such as sitting, typing, and video conferencing.

About Hinge Health

At Hinge Health, we're using technology to scale and automate the delivery of healthcare - starting with musculoskeletal (MSK) conditions, which affect over 1.7 billion people worldwide. With an AI-powered human-centered care model, Hinge Health leverages cutting-edge technology to improve outcomes and make care more accessible, efficient, and humane.