CISO - AI-Driven Health Security Leader (Hybrid)

Spring Health; San Francisco (CA); Hybrid; USD 299,000 - 344,000; Full time

Benefits offered by this job

Health, Dental, Vision

401(k) matching

No-cost therapy visits

Parental leave

Professional development reimbursement

Donation matching

Job summary

Spring Health is seeking a seasoned Chief Information Security Officer to lead enterprise-wide information security, compliance, and IT strategy in a fast-growing, AI-driven health tech company. Based in NYC or SF, this hybrid role requires building a security organization that protects patient data, enables product velocity, and partnerships with Legal, Privacy, and Engineering.

You will drive risk management, incident response, audits, and regulatory readiness across HIPAA, SOC 2, ISO 27001,

Qualifications

• 15+ years of progressive information security, IT risk, or related roles.
• Executive leadership experience guiding multi-function security teams.
• Strong knowledge of HIPAA, HITRUST, SOC 2, ISO 27001, PCI DSS, GDPR/CCPA.

Responsibilities

• Develop and execute enterprise-wide information security, compliance, tech risk, and IT strategy.
• Lead Security Operations, App/Product Security, cloud security, GRC, identity, access, and risk.
• Partner with Legal, Privacy, Compliance, Engineering, and Product to enable the business with security.
• Advise executive leadership and Board on cybersecurity risk, resilience, and investments.
• Scale the security organization, establish ownership, rhythms, and structure for growth.
• Oversee incident response, threat intelligence, vulnerability management, and resilience testing.
• Govern IT operations, vendor governance, cyber insurance, audits, and regulatory programs.
• Define AI security strategy, guardrails, data classification, and safe adoption.

Skills

Executive security leadership

Security operations

Cloud security

Information security governance

GRC / compliance

Incident response

Third-party risk management

Legal/Privacy collaboration

AI security governance

Security architecture & IAM

Education

CISSP / CISM / CCISO

Job description

Spring Health is seeking a seasoned Chief Information Security Officer to lead enterprise-wide information security, compliance, and IT strategy in a fast-growing, AI-driven health tech company. Based in NYC or SF, this hybrid role requires building a security organization that protects patient data, enables product velocity, and partnerships with Legal, Privacy, and Engineering.

You will drive risk management, incident response, audits, and regulatory readiness across HIPAA, SOC 2, ISO 27001,