The situation
After a Series A round, a clinical workflow platform used by hospitals and community care providers had to move from a founder-built Azure environment to something that would pass a SOC 2 audit and satisfy hospital privacy officers under PHIPA. The CTO had a quarter to hire a cloud lead, two engineers, and a security analyst, all remote across Canada, and had already lost two months to a generalist agency sending profiles without regulated-industry experience.
The brief
Four hires, one quarter, with a non-negotiable: every hire had to have worked in a regulated environment and be able to explain what that meant in practice. Salary bands were competitive but not top-of-market, so the mission and the remote model had to do some of the work.
What we did
- Sequenced the hires. Cloud lead first, so the lead could interview the engineers. Security analyst in parallel, since that role reported to the CTO directly.
- Interviewed for regulated experience, not keywords. Our technology consultant asked every candidate to walk through a real control they had implemented for a privacy or security framework. About half of otherwise strong candidates could not, and did not proceed.
- Positioned the role honestly. Below-top-of-market pay, but fully remote, mission-driven, and a chance to build the platform from a clean architecture. That attracted engineers from banks and large enterprises who wanted scope rather than a raise.
- Ran a shared tracker so the CTO could see every candidate's stage and interview slot without a status meeting.
The outcome
The cloud lead started in week five, the security analyst in week seven, and the two engineers in weeks nine and eleven. The company passed its SOC 2 Type I audit the following quarter and its first hospital privacy assessment without findings. All four were still in role at the twelve-month mark. The CTO has since used us for a data engineer and a platform engineer.
What made the difference
A consultant who could tell the difference between a candidate who had read about PHIPA and one who had built controls for it, and a hiring sequence that let the new lead shape the team.