Chief Information Security Officer (CISO) / Directeur de la sécurité de l'information

OpenKrill; United States; Remote; USD 220,000 - 360,000; Full time

Job summary

Insurity is seeking a strategic, operational Chief Information Security Officer to lead enterprise security, privacy, and risk programs for a growing SaaS company. The CISO will align security with business goals, drive cloud adoption, international expansion, and responsible AI use while coordinating with executives and regulators.

The role requires credible leadership, capability to translate complex risk into business decisions, and the ability to build teams, processes, and culture to

Responsibilities

• Develop, implement, and continuously improve Insurity’s enterprise information security strategy, policies, standards, and control framework.
• Establish security priorities that align with business strategy, product roadmaps, customer commitments, and risk appetite.
• Reinforce an enterprise security governance structure with reporting to executive team and Board.
• Define accountability for security across Engineering, Product, Corporate IT, Cloud Operations, Legal, Privacy, and Compliance.
• Provide risk-mitigating direction for initiatives with technology, data, cloud, product, or customer-security implications.
• Maintain a forward-looking view of emerging threats, technologies, regulations, and business risks.
• Own and mature HIPAA compliance and PHI protection programs where applicable.
• Lead HIPAA risk analyses, risk treatment, control testing, and program evaluations.
• Lead security components of PHI breach assessment, containment, investigation, and remediation.
• Establish AI security and governance requirements for AI/ML and generative AI use.
• Define controls for AI-specific risks and data protection across AI systems.
• Oversee security operations including monitoring, vulnerability management, and incident response.

Skills

Strategic leadership

Security operations

Incident response

Regulatory compliance

Executive communication

Audit & governance

Education

Bachelor's or Master's in CS/IS

Job description

Who We Are

Insurity empowers insurance organizations to quickly capitalize on new opportunities by delivering the world’s most configurable, cloud-native, easy-to-use, and intuitively analytical insurance software. Just as importantly, we empower our people—providing the tools, support, and opportunities they need to grow and succeed.

We don’t just make bold promises—we deliver results. As the largest cloud-based software provider for the Property & Casualty market, Insurity is trusted by 22 of the top 25 P&C carriers and 7 of the top 10 wholesale brokers in the MGA space. Behind that trust is a team that delivers exceptional value and deep industry expertise.

While our technology sets us apart, it’s our people who truly make the difference. At Insurity, you’ll collaborate with some of the most creative and knowledgeable minds in insurance tech—in a culture that fosters innovation, teamwork, and continuous learning. Our award-winning onboarding experience welcomes and supports you from the moment you accept our offer.

Insurity’s NextChief Information Security Officer (CISO)

Insurity is seeking a strategic, operational, and technically credible Chief Information Security Officer to lead Insurity’s enterprise security, cybersecurity risk and privacy programs.

The CISO will protect Insurity’s information assets, products, customer environments, and technology ecosystem while enabling growth, cloud adoption, international expansion, and responsible use of artificial intelligence. This leader will translate cybersecurity, privacy, compliance, and technology risk into clear business decisions for executive leadership and the Board.

The successful candidate will combine executive presence with practical execution. They need to be comfortable setting strategy, leading through influence, engaging with customers executives and regulators, directing major incidents, reviewing architecture, and building the processes, team, and culture required for a growing SaaS company.

What OurChief Information Security Officer (CISO)Will Do

Enterprise security strategy and governance

• Develop, implement, and continuously improve Insurity’s enterprise information security strategy, policies, standards, and control framework.
• Establish security priorities that align with business strategy, product roadmaps, customer commitments, and the organization’s risk appetite.
• Reinforce an enterprise security governance structure, including executive steering forums and appropriate reporting to the executive team and Board of Directors.
• Define clear accountability for security across Engineering, Product, Corporate IT, Cloud Operations, Legal, Privacy, and Compliance business functions.
• Provide risk-mitigating direction for initiatives with technology, data, cloud, product, or customer-security implications.
• Maintain a forward-looking view of emerging threats, technologies, regulations, and business risks.

HIPAA, PHI data protection

• Own and mature Insurity’s HIPAA compliance and electronic protected health information program where applicable to Insurity’s products, services, customers, vendors, and business operations.
• Lead documented HIPAA risk analyses, risk treatment plans, control testing, remediation tracking, and periodic program evaluations.
• Ensure appropriate administrative, physical, and technical safeguards for protected health information, including access control, authentication, audit controls, integrity, transmission security, encryption, contingency planning, and workforce security.
• Partner with Legal, Privacy, Compliance, Product, and Customer Success on the HIPAA Privacy, Security, and Breach Notification Rules.
• Establish requirements for Business Associate Agreements, customer obligations, subcontractors, cloud providers, and other third parties that create, receive, maintain, or transmit PHI.
• Maintain audit-ready evidence and support customer diligence, independent assessments, regulatory inquiries, and OCR requests.
• Lead the security component of PHI breach assessment, containment, investigation, notification coordination, and post-incident remediation.
• Ensure HIPAA-specific workforce training, sanctions, and awareness requirements are incorporated into the broader security program.

AI security, governance, and responsible adoption

• Establish and lead Insurity’s enterprise AI security and governance program.
• Maintain an inventory of AI, machine learning, large language model, generative AI, and agentic systems used, developed, procured, or embedded in Insurity products and operations.
• Define AI intake, risk classification, ownership, approval gates, prohibited uses, and human-oversight requirements.
• Establish secure-use standards for generative AI, including requirements for confidential information, PHI, PII, customer data, source code, proprietary data, prompts, outputs, retention, and model training.
• Define controls for AI-specific risks, including prompt injection, data leakage, insecure agents and tools, model abuse, data poisoning, supply-chain risk, unauthorized access, and unreliable or harmful outputs.
• Partner with Legal, Privacy, Product, Engineering, Data, and Compliance to address transparency, intellectual property & data rights of emerging AI regulations.
• Incorporate AI security and governance requirements into procurement, third-party risk management, secure development, cloud architecture, product reviews, and customer commitments.

Risk management, compliance, and assurance

• Develop a risk-based process for identifying, assessing, prioritizing, treating, and accepting information security and technology risks across Insurity’s ecosystem.
• Maintain alignment with applicable requirements and leading practices, including HIPAA, SOC 2, ISO/IEC 27001, GDPR & the NIST Cybersecurity Framework.
• Orchestrate internal and external audits through planning, evidence collection, testing, findings management, remediation, and executive reporting.
• Establish control ownership, evidence standards, issue-management processes, and sustainable remediation tracking.
• Advise management on the costs, value, and risks of security and technology investments.
• Support cyber-insurance requirements, underwriting reviews, claims preparation, and risk-improvement initiatives.
• Monitor regulatory and contractual changes and translate them into practical requirements, policies, and implementation plans.
• Report material risks, exceptions, incidents, and remediation plans to executive leadership and the Board.

Security operations and incident response

• Lead the enterprise security operations program, including monitoring, threat intelligence, vulnerability management, detection and response, penetration testing, and security investigations.
• Manage security incident response coordinating both internally and externally from inception to resolution.
• Maintain an incident response program that covers c