Chief Information Security Officer

Spring Health; San Francisco (CA); Remote; USD 260,000 - 360,000; Full time

Benefits offered by this job

Health benefits starting day one

401(k) match

Flexible work arrangements

Professional development reimbursement

Parental leave

Job summary

Spring Health seeks a visionary Chief Information Security Officer to define and advance enterprise-wide information security, compliance, technology risk, and IT strategy.

Reporting to the CTO, you will lead Security Operations, App/Product Security, cloud and infrastructure security, identity and access management, third-party risk, and incident response while enabling growth and regulatory readiness across healthcare data protection.

Qualifications

• 15+ years of progressive experience across Information Security, cybersecurity, IT, technology risk, or related disciplines.
• Significant experience in executive security leadership roles.
• Strong knowledge of HIPAA, SOC 2, ISO 27001, PCI DSS, GDPR, CCPA, and healthcare privacy requirements.

Responsibilities

• Define and execute Spring Health’s enterprise-wide information security, compliance, technology risk, and IT strategy.
• Lead Security Operations, Application/Product Security, cloud and infrastructure security, IAM, third‑party risk, and incident response.
• Partner with CTO, Legal, Privacy, Compliance, Product, Engineering, Sales, Customer Success, People, Finance, and other stakeholders to enable the business.

Skills

Executive leadership

Information security

Cloud security

Regulatory compliance

Incident response

HIPAA knowledge

Job description

• The Chief Information Security Officer will be responsible for defining, leading, and advancing Spring Health’s enterprise-wide information security, technology risk, compliance, and IT strategy
• This leader will ensure the protection of company assets, customer data, member data, provider data, and critical systems while enabling business growth, innovation, and operational scale
• Reporting to the Chief Technology Officer, the CISO will lead the company’s Information Security, Compliance/GRC, and IT functions, including Security Operations, Application/Product Security, cloud and infrastructure security, identity and access management, third-party risk, incident response, enterprise compliance, corporate IT, and business technology operations
• This leader will manage and partner closely with senior security and IT leaders, including the VP, Information Security
• The CISO will serve as a trusted advisor to executive leadership and the Board on cybersecurity risk, regulatory readiness, enterprise resilience, customer trust, and technology risk
• They will play a critical role in Spring Health’s next phase of scale, including the integration of Alma, enterprise customer growth, AI transformation, international expansion, and readiness for future public-company expectations
• This leader will be responsible for building a security and IT organization that enables the business, supports product velocity, protects sensitive healthcare data, and earns the trust of customers, members, providers, partners, regulators, and employees
• Develop and execute Spring Health’s enterprise-wide information security, compliance, technology risk, and IT strategy in alignment with company priorities, growth plans, and regulatory obligations
• Lead the Information Security, Compliance/GRC, and IT organizations, including Security Operations, Application/Product Security, cloud and infrastructure security, enterprise compliance, corporate IT, identity and access management, and business technology operations
• Partner closely with the CTO, executive leadership team, Legal, Privacy, Compliance, Product, Engineering, Sales, Customer Success, People, Finance, and other stakeholders to ensure security and IT enable the business rather than create unnecessary friction
• Serve as a trusted advisor to executive leadership and the Board on cybersecurity risks, technology risk, regulatory readiness, incident response, enterprise resilience, customer trust, and security investments
• Build and scale a high-performing organization across security, compliance, and IT, including developing leaders, clarifying ownership, improving operating rhythms, and ensuring the team has the right structure, capabilities, and culture for Spring’s next stage of growth
• Oversee enterprise security operations, including threat detection, vulnerability management, incident response, security monitoring, endpoint security, SIEM strategy, threat intelligence, and resilience exercises
• Ensure Spring Health’s Application/Product Security and cloud security programs are deeply embedded in the software development lifecycle, including secure architecture, threat modeling, automated testing, vulnerability remediation, and security review processes
• Own the enterprise compliance and information security risk management program, including risk assessments, risk registers, risk treatment plans, control frameworks, policy governance, and executive reporting
• Ensure successful compliance outcomes across applicable frameworks and regulations, including HIPAA, HITRUST, SOC 2, ISO 27001, PCI DSS, GDPR, CCPA, and other healthcare, privacy, and security requirements
• Partner with Legal and Privacy on data protection, privacy, regulatory obligations, Business Associate Agreements, customer commitments, breach assessment, notification obligations, and evolving healthcare security requirements
• Lead security and IT strategy related to the Alma integration, including systems, data flows, access controls, compliance obligations, enterprise risk, provider/member/customer data protection, and long-term operating model decisions
• Define and govern Spring Health’s AI security strategy, including enterprise AI guardrails, approved tool usage, data classification, model/tool risk assessment, secure AI adoption, and protection of sensitive healthcare and business data
• Oversee corporate IT and business technology operations, including employee technology experience, endpoint management, access lifecycle, SaaS governance, corporate applications, IT service delivery, and operational excellence
• Serve as a senior executive sponsor in strategic enterprise customer conversations, including security reviews, audits, RFPs/RFIs, customer escalations, and technical diligence with large enterprise buyers
• Build scalable customer trust processes, security narratives, artifacts, and evidence practices that reduce friction for Sales and Customer Success while maintaining strong risk discipline
• Lead the organization’s response to significant security incidents, including technical response, executive communication, customer communication, legal/compliance partnership, regulatory considerations, post-incident review, and remediation
• Manage security, compliance, and IT budgets, vendor relationships, tooling strategy, cyber insurance engagement, external audit partnerships, and key technology investments
• Establish security, compliance, and IT metrics that give executive leadership and the Board clear visibility into risk posture, program maturity, operational performance, and investment priorities
• Drive a company-wide culture of security, privacy, accountability, and responsible innovation
• What Success Looks Like:
• A clear, enterprise-wide security, compliance, and IT strategy is in place with defined priorities, milestones, KPIs, ownership, and executive/Board visibility
• The Security, Compliance/GRC, and IT teams have a clear operating model, strong leadership, healthy collaboration, and the right structure to support Spring’s scale post-Alma
• Spring Health maintains strong regulatory and compliance outcomes, including successful audits, certifications, customer reviews, and healthcare compliance obligations
• Security and IT are viewed as business enablers by Product, Engineering, Sales, Customer Success, Legal, Compliance, People, Finance, and executive leadership
• Alma integration work is progressing with clear security, compliance, IT, data, access, and risk-management priorities
• AI adoption is supported by clear security guardrails, practical governance, and scalable controls that enable innovation while protecting sensitive data
• Enterprise customer security reviews, audits, RFPs/RFIs, and escalations are handled efficiently and credibly, with repeatable processes that reduce friction and build customer trust
• Security is embedded in product and engineering workflows, with clear requirements, tooling, review processes, and accountability across the SDLC
• Incident response, crisis management, business continuity, and operational resilience programs are tested, understood, and effective
• Corporate IT provides a strong employee experience while maintaining disciplined access management, endpoint security, SaaS governance, and operational controls
• Executive leadership, customers, partners, auditors, regulators, and the Board have confidence in Spring Health’s security, compliance, and IT posture
• Every Spring Health team member is expected to use AI tools thoughtfully, apply human judgment to AI outputs, and keep building AI fluency in ways that support their role and our mission

Benefits

• Health, Dental, Vision benefits start on your first day at Spring Health. You and your dependents also receive an individual One Medical account which is valued at $199/year per user. HSA and FSA plans available
• A yearly allotment of no cost visits to the Spring Health network of therapists, coaches, and medication management providers for you and your dependents
• 10 allocated sick days per year
• Flexible paid time off in addition to 12 paid holidays throughout the year
• Access to Gympass, an on-demand virtual benefit that provides wellbeing coaching, and budget management
• Spring Renewal: When you hit your four-year Springaversary, you’ll be awarded a four week, fully paid, sabbatical leave to renew and recharge
• 4-4.5 months of fully paid parental leave
• Spring Health provides team members and their families with sponsored access to Bright Horizons® child care, back-up care, and elder care
• Access to fertility care support through Carrot, in addition to $4,000 reimbursement for related fertility expenses
• Our People team benchmarks all salaries using the Radford Global Compensation Database for technology and life sciences industries. Radford benchmarks salaries with 3,589 global firms, 6.5 million employees, and 98 countries across the globe. We do this to ensure all of our team members are paid equally and competitively
• On top of competitive and benchmarked salary, Spring Health offers incentive pay (based on role), and equity that begins vesting as we celebrate your first year with the company!
• Employer sponsored 401(k) match of up to 2% after 90 days of employment
• Flexible work arrangements: 66% of Spring Health team members work fully remote while 33% work in a hybrid model from our New York City offices
• Focus Fridays: no meetings, no distractions, just time for you to get work done
• Focus Weeks: In Spring 2023, we held our first ever Focus Week, we canceled all non-essential meetings, minimized distractions, and you, our team members, to dive into the key work that gets chopped up or deprioritized during the regular day-to-day. We saw a 36% jump in the average energized score after those five days of flow state work and are finalizing a plan for quarterly Focus Weeks for team members
• Up to $1,000 Professional Development Reimbursement per calendar year
• $200 per year donation matching to support your favorite causes

Experience serving as an executive security leader in customer-facing enterprise security reviews, audits, RFP/RFI responses, technical diligence, and customer escalations15+ years of progressive experience across Information Security, cybersecurity, IT, technology risk, or related disciplines, with significant experience in executive security leadership rolesStrong technical fluency across cloud security, application security, identity and access management, security architecture, threat management, vulnerability management, incident response, and modern SaaS architecturePractical experience developing AI security strategy, enterprise AI governance, data classification practices, and guardrails for safe AI adoptionExperience owning or overseeing HITRUST, SOC 2, ISO 27001, PCI DSS, GDPR, CCPA, and other relevant third-party security, privacy, and compliance programsDemonstrated ability to communicate cybersecurity and technology risk to executive and Board-level audiences, translating technical issues into business, financial, customer, and regulatory impactStrong understanding of healthcare technology, sensitive data environments, enterprise customer expectations, and the security/compliance requirements that come with serving large employers, health plans, providers, members, and partnersExperience leading security and/or IT through M&A integration, divestitures, major business transformation, IPO readiness, public-company readiness, or other high-complexity operating environmentsOne or more recognized industry certifications relevant to a role at this level preferred, such as CISSP, CISM, CCISO, CRISC, CISA, or similar credentialsExperience partnering effectively with Legal, Privacy, Compliance, Engineering, Product, Sales, Customer Success, People, Finance, and executive leadershipExperience leading or closely partnering with IT, corporate technology, business applications, employee technology, endpoint management, SaaS governance, and access lifecycle functionsDemonstrated experience leading multi-functional security organizations across Security Operations, Application/Product Security, cloud security, GRC/compliance, identity and access management, incident response, and third-party riskDeep working knowledge of HIPAA and hands-on experience leading security and compliance programs in a covered entity or business associate environmentStrong business judgment and ability to balance security, compliance, customer trust, employee experience, product velocity, innovation, and operational efficiencyExperience building and scaling high-performing teams, including hiring, developing leaders, clarifying operating models, and driving accountability across multiple functions