Director, Information Security
New
C
CarrotDigital health
United States (Remote)Full-TimeDirector
SalaryThe starting base salary for this position will range from $188,000.00 - $245,000.00.
Apply NowOpens the employer's application page
Job Details
- Experience
- 10+ years of experience in technology, including 5+ years in information security and at least 3 years leading security teams
- Required Skills
- AWSAzureHIPAA
Requirements
- Bachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent experience.
- 10+ years of experience in technology, including 5+ years in information security and at least 3 years leading security teams.
- A security certification such as CISSP or CISM.
- Experience leading the security function at a late-stage startup, scale-up, or public company.
- Working depth in healthcare data protection and privacy frameworks, including HIPAA, GDPR, and CCPA/CPRA.
- Experience overseeing enterprise frameworks and audits such as SOC 2 Type II, HITRUST, PCI DSS, and ISO 27001.
- Strong knowledge of application, network, and cloud security, including AWS and Azure, and frameworks such as NIST CSF and OWASP.
- Experience running incident response, risk management, vulnerability management, penetration testing, and security awareness programs.
- Executive-level communication skills and confidence engaging customers and sales teams on security requirements.
- Experience managing budgets and allocating resources across people, tools, and vendors.
Responsibilities
- Lead the security strategy and roadmap using a recognized maturity model such as C2M2 or NIST CSF.
- Own corporate security programs, including GRC, incident management, security awareness, and third-party risk.
- Own product security across application, cloud, infrastructure, and secure SDLC.
- Partner with Engineering, especially the Internal Platform team, to build security into system design, delivery, and operations.
- Lead risk assessments across application, cloud, and corporate environments and prioritize technical safeguards.
- Manage the compliance portfolio, including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA, and prepare for additional frameworks as needed.
- Direct incident response readiness, including playbooks, tabletop exercises, executive communications, and post-incident learning.
- Represent Carrot’s security posture in customer reviews, questionnaires, and strategic sales conversations.
- Work with Legal and Privacy on global data protection requirements for member health data.
- Build and coach the security team, manage budgets, tools, and vendors, and tailor security guidance for a remote-first workforce and physical offices.
View Full Description & ApplyYou'll be redirected to the employer's site
