CISO: Healthcare Security & AI Risk Leader

Spring Health; New York (NY); Hybrid; USD 299,000 - 344,000; Full time

Benefits offered by this job

Health Coverage

401k Match

Therapy Visits

Parental Leave

Fertility Support

Dev Reimbursement

Donation Matching

Job summary

Spring Health seeks a world-class Chief Information Security Officer to define and advance enterprise-wide information security, risk, and IT strategy. You will lead Security Operations, Application/Product Security, cloud security, and compliance, partnering with Legal, Privacy, and Product leaders to enable growth while protecting patient and company data.

This hybrid role is based in NYC or SF with 2–3 days in office.

Qualifications

• 15+ years of progressive experience in information security and IT risk, including executive leadership roles.
• Deep knowledge of HIPAA, privacy, and healthcare security requirements.
• Proven ability to build and scale security, compliance, and IT teams.

Responsibilities

• Define and lead enterprise-wide information security, compliance, and IT strategy.
• Oversee Security Operations, Application/Product Security, and cloud security.
• Manage risk, incident response, and third-party risk management.
• Partner with Legal, Privacy, Product, Engineering, and Sales to enable business goals.
• Build scalable security programs, governance, and reporting for Board visibility.
• Drive AI security governance and guardrails for safe AI adoption.
• Lead regulatory readiness, audits, and certifications across HIPAA, SOC 2, ISO 27001, GDPR, and more.
• Manage budgets, vendor relationships, and security investments.

Skills

Executive security leadership

Information Security

Cloud security

GRC/compliance

Incident response

Security operations

AI security governance

Job description

Spring Health seeks a world-class Chief Information Security Officer to define and advance enterprise-wide information security, risk, and IT strategy. You will lead Security Operations, Application/Product Security, cloud security, and compliance, partnering with Legal, Privacy, and Product leaders to enable growth while protecting patient and company data.

This hybrid role is based in NYC or SF with 2–3 days in office.