Chief Information Security Officer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of Qualified Health’s enterprise security strategy, risk posture, and strategic roadmap.

• Provide counsel to executive leadership regarding significant risks, decisions on risk acceptance, security investments, as well as new products and customer interactions.

• Develop and implement security governance, policies, metrics, and accountability throughout the organization.

• Build and expand the security team while determining the optimal blend of internal expertise, external partnerships, and capabilities.

• Define the technical security direction across application security, cloud infrastructure, identity and access management, vulnerability management, and secure software development.

• Collaborate with Engineering and Product teams to integrate security into architecture, development, testing, deployment, and operational processes.

• Implement protections for AI-enabled products and workflows, ensuring the safeguarding of PHI across LLM integrations, AI agents, data pipelines, and interconnected systems.

• Address high-impact technical risks, balancing security rigor with the need for product velocity.

• Provide strategic guidance and technical leadership for the design and implementation of secure AI infrastructure.

• Manage DevOps and cloud infrastructure to guarantee reliable, scalable, and secure platform operations.

• Oversee the security program that meets HITRUST, SOC 2, and relevant customer and regulatory requirements.

• Convert contractual and regulatory obligations into actionable controls.

• Lead security diligence for enterprise customers, conducting technical assessments and managing escalations.

• Collaborate with Commercial and Customer Success teams to overcome security-related hurdles in deals.

• Assess third-party and vendor risks, determining when additional frameworks or certifications are necessary.

• Manage security incident response, which includes detection, escalation, investigation, containment, recovery, and post-incident remediation.

• Establish and evaluate incident response, business continuity, and disaster recovery plans.

• Assist the Privacy Team in fulfilling reporting obligations under HIPAA and state privacy regulations.

• Develop the operating model, tools, processes, and external collaborations for effective security operations.

• Foster security awareness and ownership within Engineering, IT, and other business units.

⛳️ Requirements

• 12+ years of experience in information security or cybersecurity, including substantial leadership roles in enterprise or rapidly growing technology firms.

• Experience functioning as a CISO, VP of Security, or in another equivalent senior leadership position.

• Responsibility for enterprise security strategy, risk management, and engagement with executives.

• Proven history of establishing and expanding security programs, including foundational controls, governance, technical capabilities, and teams.

• Profound technical knowledge of cloud security, application security, identity and access management, vulnerability management, and incident response.

• Experience leading or managing HIPAA and SOC 2 program success, encompassing control implementation, audit preparedness, and remediation efforts.

• Competence in protecting sensitive or regulated data and translating compliance requirements into effective technical controls.

• Experience conducting enterprise customer security evaluations and articulating security posture and risk to senior stakeholders.

• Ability to influence executive leadership and cross-functional teams while aligning risk management with business objectives.

• Background in a high-growth healthcare technology, healthcare AI, life sciences technology, or enterprise SaaS organization.

• Familiarity with securing AI-enabled applications, LLM-based systems, AI agents, or platforms managing sensitive healthcare information.

• Knowledge of HITRUST, NIST Cybersecurity Framework, or NIST AI Risk Management Framework.

• Experience presenting security posture, significant risks, and investment proposals to a board or board-level committee.

• Practical experience leading or collaborating closely with DevOps, SRE, or platform engineering teams.

• Relevant certifications such as CISSP, CISM, or CCSP.

• Legally authorized to work in the United States for any employer without the need for sponsorship now or in the future.

🏝️ Benefits

• Equity packages

• Medical, dental, and vision insurance

• Flexible working hours

• Hybrid work options

• Inclusive environment that encourages creativity and innovation

• Competitive salary