Vice President, Information Security

Role overview Lead and expand an enterprise information security program in a regulated healthcare environment. Reporting to the compliance executive and partnering with technology and business leaders, this executive role owns security strategy, governance, operations, and budget. It combines leadership and customer trust responsibilities with hands-on oversight of architecture reviews, risk assessments, incident response, and security evaluations.

Responsibilities - Set enterprise security strategy and a multi-year roadmap aligned with business growth, regulatory duties, and customer expectations. - Evolve the threat-based risk program and report on security posture, maturity, investment needs, and emerging risks to executives and board stakeholders. - Own security budgets and resource decisions, making the case for investments based on risk reduction and business needs. - Establish and oversee standards for cloud and application security, endpoint protection, and identity and access management. - Lead third-party and cyber risk management, including security decisions for vendors handling protected health information and cyber insurance oversight. - Serve as the senior security counterpart to customer security leaders and support due diligence for partnerships, acquisitions, and new business initiatives.

Requirements - Executive-level experience leading enterprise information security programs, preferably in healthcare or another regulated industry. - Strong knowledge of healthcare security and privacy obligations, enterprise security controls, and threat-based risk management. - Experience setting security strategy, governing a roadmap, managing budgets, and allocating resources. - Ability to lead a small team while remaining engaged in technical reviews, risk assessments, incident response, and customer security work. - Strong executive communication and stakeholder management skills, including the ability to explain risk and reach alignment across functions. - Experience leading security due diligence and recommending remediation based on business impact.

Nice to have - CISSP, CISM, or similar certification; HITRUST practitioner or audit experience. - Familiarity with CMS data handling requirements and security expectations for government payors.

Benefits and work setup Benefits include medical, dental, and vision coverage; flexible paid time off; family and caregiver leave; gym and commuter programs; health and lifestyle spending benefits; stock options; and a 401(k) match. Some perks, such as sponsored lunch, apply to office staff.