Vice President of Engineering, Chief Information Security Officer (CISO)

About the position At Collective Health, we're transforming how employers and their people engage with their health benefits by seamlessly integrating cutting-edge technology, passionate service, and world-class user experience design. We all depend on healthcare throughout our lifetimes, for ourselves, and our families and friends, but it is notoriously difficult to navigate and understand. As an industry that comprises 20% of the US economy, we think healthcare should work better for all of us. At Collective Health, we believe it's time for a new day in healthcare where members are informed and empowered to make the right care choices when the decisions are urgent and critical. The CISO and Vice President of Engineering will be responsible for overseeing the strategic direction, development, and operation of the company's Cyber Security, Cloud infrastructure & SRE, and IT practices. The CISO will lead the information security team, collaborate continuously with the company's Privacy, Risk, and Compliance Team, and help business leaders—and our board—ensure that security resources and practices align to business needs, priorities, and requirements. This role requires a visionary leader who can drive innovation, optimize processes, and ensure the security and reliability of our systems. Responsibilities • Develop and implement a comprehensive security and IT/cloud infrastructure strategy that supports the company's overall business objectives. • Lead, mentor, and manage a high-performing team of security SRE, and IT professionals. • Foster a culture of innovation, continuous improvement, and collaboration within the department. • Work with senior leadership to align security and IT initiatives with business goals. • Establish and maintain an enterprise-wide information security management program with clear information security policies and procedures. • In partnership with Chief Privacy and Compliance officer, update and guide senior leadership and the Board of Directors on current cyber threats, issues, and risks, and provide regular status updates on progress and status of initiatives and operations. • Oversee the information security organization with an emphasis on the effectiveness of security controls. • Manage security incidents and events to include containment, communication and coordination across all relevant business functions. • Establish and maintain disaster recovery and business continuity plans. • Oversee the development and implementation of DevSecOps practices to improve software delivery and operational efficiency. • Promote a culture of automation, continuous integration, and continuous deployment (CI/CD). • Ensure high reliability and uptime for the cloud applications. • Oversee the management and maintenance of IT infrastructure, including networks, servers, databases, and cloud environments. • Ensure the security, scalability, and reliability of IT systems. • Implement and maintain disaster recovery and business continuity plans. • Develop and manage the departmental budget, ensuring cost-effective use of resources. • Allocate resources to various projects and initiatives based on strategic priorities. • Collaborate with other departments to understand their IT needs and provide solutions that support their goals. • Communicate IT strategy, progress, and performance to executive leadership and stakeholders. Requirements • Bachelor's degree in Computer Science, Information Technology, or a related field; Master's degree preferred. • 15+ years of experience leading teams with at least 5 years in a Director and above role leading cyber security teams in a product development environment. • Strong security architecture background with experience building and driving a cyber security strategy and framework. • Knowledge of common information security management frameworks, such as ISO/IEC 27001, NIST, HITRUST and HIPAA compliance requirements. • Experience with leading control assessments such as SOC 1/SOC 2. • Deep healthcare expertise and Security certifications such as CISSP are required. • 5+ years of experience building cloud infrastructure in AWS and automating infrastructure through infrastructure as code practices. • Strong understanding of cloud technologies, cybersecurity, and IT best practices. • Experience with GCP will be nice to have. • Excellent leadership, communication, and interpersonal skills. • Ability to think strategically and align IT initiatives with business goals. • Strong problem-solving and decision-making skills. • Experience in budget management and resource allocation. Nice-to-haves • Experience with GCP will be nice to have. Benefits • Health insurance • 401k • Paid time off • Stock options Apply tot his job