Chief Information Security Officer – CISO

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead Insurity’s enterprise security, cybersecurity risk, and privacy initiatives.

• Safeguard information assets, products, customer environments, and the technology ecosystem while supporting growth, cloud adoption, international expansion, and responsible AI utilization.

• Convert cybersecurity, privacy, compliance, and technology risks into informed business decisions for executive leadership and the Board.

• Develop and enhance the enterprise information security strategy, policies, standards, and control frameworks.

• Set security priorities that align with business strategy, product roadmaps, customer commitments, and risk appetite.

• Maintain security governance, executive steering committees, and provide reports to executive leadership and the Board.

• Oversee HIPAA compliance and ePHI protection initiatives, including risk analyses, safeguards, audits, breach assessments, and workforce training.

• Establish and manage AI security and governance, which includes AI inventories, risk classification, approval gates, secure-use standards, and controls for AI-specific risks.

• Drive risk management, compliance, assurance, audits, remediation efforts, cyber-insurance support, and regulatory requirements.

• Direct security operations, threat intelligence, vulnerability management, detection and response, penetration testing, investigations, and incident management.

• Coordinate incident responses related to cyber threats, privacy issues, PHI, ransomware, cloud breaches, insider threats, supply chain risks, and AI-related incidents.

• Lead crisis tabletop exercises, simulations, communication strategies, breach-disclosure protocols, and post-incident enhancements.

• Integrate security-by-design principles throughout product development, architecture, engineering, DevOps, and change management processes.

• Supervise application, software supply chain, cloud, infrastructure, identity, encryption, secrets management, network practices, logging, monitoring, data loss prevention, and secure configuration.

• Review and authorize security architecture for products, platforms, infrastructure modifications, AI systems, and customer-facing functionalities.

• Establish third-party security and privacy risk management protocols for vendors, cloud providers, subprocessors, partners, and supply chain participants.

• Maintain practices for data classification, inventory, data flow, retention, deletion, residency, and access governance.

• Build and lead a high-performing security team; recruit, mentor, and retain security professionals.

• Manage security awareness and role-based training initiatives.

• Oversee the security budget, partner strategies, managed service providers, and external security resources.

• Define and report on security metrics, risk indicators, maturity assessments, control health, remediation progress, incident trends, audit outcomes, customer commitments, and AI governance metrics.

⛳️ Requirements

• Bachelor’s degree in information security, computer science, information technology, business, or a related discipline; equivalent experience may be acceptable.

• 8–10 years of progressive experience in information security, cybersecurity, technology risk, or related fields within a SaaS, cloud, technology, insurance, healthcare, or similarly regulated environment.

• A minimum of 5 years of executive or senior leadership experience in roles such as CISO, Deputy CISO, Head of Security, or a comparable position.

• Proven experience in building and managing an enterprise security program across a distributed or remote organization.

• Familiarity with HIPAA, ePHI, Business Associate requirements, healthcare data protection, or other comparable regulated-data obligations.

• Demonstrated experience in leading security risk assessments, audits, remediation initiatives, and regulatory or customer assurance activities.

• Experience in managing significant incidents, crisis responses, business continuity, disaster recovery, and executive communications.

• Experience in establishing or managing AI security, AI governance, responsible AI, model risk, or secure generative AI programs.

• Strong knowledge of cloud, SaaS operating models, identity management, encryption, application security, vulnerability management, incident response, and third-party risk.

• Exceptional written, verbal, presentation, negotiation, and stakeholder-influencing abilities.

• Proven capability to manage budgets, partners, vendors, priorities, and complex cross-functional programs.

• Proficiency in English is required for this position.

• Preferred: CISSP, CISM, CISA, CRISC, CCSP, or equivalent certification.

• Preferred: Experience with SOC 2 Type II, ISO/IEC 27001, NIST CSF, NIST AI RMF, or comparable frameworks.

• Preferred: Experience with AI/ML security, LLM security, agent security, model risk management, AI impact assessments, or AI red teaming.

• Preferred: Experience supporting customer security reviews, RFPs, renewals, and executive-level trust discussions.

• Preferred: Experience in insurance technology, property and casualty insurance, healthcare technology, or another data-intensive regulated sector.

• Preferred: Experience with cyber-risk quantification, cyber insurance, secure software supply chains, DevSecOps, and cloud-native security.

🏝️ Benefits

• Flexible work arrangements through the Flex First Workforce approach, including fully remote opportunities.

• Open PTO Policy.

• Comprehensive health coverage.

• Employer-matched retirement savings.

• Award-winning onboarding program.

• Mentorship program.

• Access to LinkedIn Learning and Kaplan.

• Discounted tuition for employees and their families through the University of Arizona Global Campus partnership.

• Employee Referral Bonus program.

• Medical insurance.

• Dental insurance.

• Vision insurance.

• 401(K) match.

• Paid maternity leave.

• Paid paternity leave.

• Disability insurance.