Senior Compliance Officer

Senior Compliance Officer Location: Remote from California, Florida, Georgia, Maryland/District of Columbia, Massachusetts, New Jersey, North Carolina, Ohio, Pennsylvania, Texas About evermore evermore is a technology company that administers Smart Benefits to connect people to products and services they need, when they need them, so they can live healthier lives. We partner with payers and retailers to deliver expansive benefits for things like healthy foods, OTC medications, or transportation. evermore is reinventing benefits administration so that everyone benefits with more value for each and better outcomes for all. evermore is a Series B stage company, backed by leading investors including General Catalyst, Define Ventures, Lightspeed Venture Partners, Pinegrove Capital Partners, and Qiming Venture Partners. The Role We are seeking an experienced and dynamic Senior Compliance Officer to support and administer our corporate compliance program and our Medicare and Medicaid compliance obligations. Reporting directly to the SVP of Legal, this role is instrumental to supporting HIPAA and federal healthcare program compliance across our company, with a particular focus on two things: our obligations as a delegated entity to health plan clients, and our oversight of third-parties and subcontractors we rely on – including business associates under HIPAA and vendors that qualify as first tier, downstream, or related entities (FDRs). The ideal candidate has a strong command of Medicare and Medicaid regulatory requirements, experience in startups or high-growth environments, and the judgment to build practical compliance controls that scale with the business. What You’ll Do Third-party and FDR oversight Manage the third-party oversight program, including due diligence, risk tiering, ongoing monitoring, and annual attestation for FDRs and Medicaid subcontractors. Partner with Legal on business associate agreements, delegation agreements, and required regulatory flow-down provisions in vendor agreements. Exclusion and preclusion screening Conduct exclusion and preclusion screening of employees, contractors, and FDRs against the OIG LEIE and SAM.gov, the CMS Preclusion List, and applicable state Medicaid exclusion lists; automating the process with IT and confirming results monthly. Incident Response and breach management Lead privacy and security incident response: intake, investigation, four-factor breach risk assessment, notification decisions, and reporting to plan clients under our delegation agreements; in cooperation with compliance colleagues across the company. Track incidents to closure, including root cause analysis and corrective action. Provide strong customer communication, expectation management, and know when to push back on client challenges. Program administration Draft and maintain compliance policies and procedures. Design and present compliance training in-house, developing internal capabilities rather than relying on outside consultants. Maintain effective lines of communication for compliance issue reporting, ensuring cross department understanding of key compliance risks and what each department must do to comply Monitoring, auditing, and corrective actions <li data-leveltext="·" data-font="Symbol" data-listid="24" data-lis