Chief Information Security Officer: Enterprise Security & Growth

Spring Health; San Francisco (CA); Remote; USD 260,000 - 360,000; Full time

Benefits offered by this job

Health benefits starting day one

401(k) match

Flexible work arrangements

Professional development reimbursement

Parental leave

Job summary

Spring Health seeks a visionary Chief Information Security Officer to define and advance enterprise-wide information security, compliance, technology risk, and IT strategy.

Reporting to the CTO, you will lead Security Operations, App/Product Security, cloud and infrastructure security, identity and access management, third-party risk, and incident response while enabling growth and regulatory readiness across healthcare data protection.

Qualifications

• 15+ years of progressive experience across Information Security, cybersecurity, IT, technology risk, or related disciplines.
• Significant experience in executive security leadership roles.
• Strong knowledge of HIPAA, SOC 2, ISO 27001, PCI DSS, GDPR, CCPA, and healthcare privacy requirements.

Responsibilities

• Define and execute Spring Health’s enterprise-wide information security, compliance, technology risk, and IT strategy.
• Lead Security Operations, Application/Product Security, cloud and infrastructure security, IAM, third‑party risk, and incident response.
• Partner with CTO, Legal, Privacy, Compliance, Product, Engineering, Sales, Customer Success, People, Finance, and other stakeholders to enable the business.

Skills

Executive leadership

Information security

Cloud security

Regulatory compliance

Incident response

HIPAA knowledge

Job description

Spring Health seeks a visionary Chief Information Security Officer to define and advance enterprise-wide information security, compliance, technology risk, and IT strategy.

Reporting to the CTO, you will lead Security Operations, App/Product Security, cloud and infrastructure security, identity and access management, third-party risk, and incident response while enabling growth and regulatory readiness across healthcare data protection.