Director, Information Security

carrotfertility; United States; Remote; USD 188,000 - 245,000; Full time

Benefits offered by this job

Flexible time off

Parental leave

Health benefits

Retirement plan

Incentives

Remote-first

Job summary

Carrot Fertility is seeking a senior information security leader to mature the program for a global digital health platform handling sensitive health data. You will set the security strategy across applications, cloud, infrastructure, and corporate systems, while partnering with Engineering and IT and guiding executive discussions.

The role blends hands-on partnership with leadership, incident readiness, and customer-facing security discussions, with a remote-first environment and offices.

Responsibilities

• Develop a multi-year security strategy and roadmap, using a recognized maturity framework to prioritize investment and report progress to executives.
• Own corporate and product security programs, including governance and risk, third-party reviews, security awareness, application and cloud security, and secure development practices.
• Partner with Engineering and platform teams to incorporate security into system design, delivery, and operations; assess risks and define technical safeguards.
• Manage recurring compliance and certification work, including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA, and prepare for additional frameworks as needed.
• Direct incident response preparation through playbooks, exercises, executive communications, and post-incident reviews.
• Work with Legal and Privacy on global data protection requirements, and represent the security program in customer reviews and sales discussions.
• Coach and grow the security team, and manage security tools, budget, vendors, and guidance for a remote workforce and offices.

Job description

Role overview

Lead and mature the information security program for a global digital health platform handling sensitive health data. You’ll set the security strategy while overseeing governance, risk, compliance, incident readiness, and product security across applications, cloud, infrastructure, and corporate systems. The position combines hands‑on partnership with Engineering and IT, team leadership, executive guidance, and customer‑facing security discussions.

Responsibilities

• Develop a multi-year security strategy and roadmap, using a recognized maturity framework to prioritize investment and report progress to executives.
• Own corporate and product security programs, including governance and risk, third‑party reviews, security awareness, application and cloud security, and secure development practices.
• Partner with Engineering and platform teams to incorporate security into system design, delivery, and operations; assess risks and define technical safeguards.
• Manage recurring compliance and certification work, including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA, and prepare for additional frameworks as needed.
• Direct incident response preparation through playbooks, exercises, executive communications, and post‑incident reviews.
• Work with Legal and Privacy on global data protection requirements, and represent the security program in customer reviews and sales discussions.
• Coach and grow the security team, and manage security tools, budget, vendors, and guidance for a remote workforce and offices.

Requirements

The available source describes the scope and outcomes of the role but does not include its qualifications, so specific experience or credentials cannot be stated reliably.

Benefits and work setup

• Flexible time off, parental leave, and family-forming support.
• Health and wellness benefits, retirement savings, and short- and long-term incentives.
• Competitive base salary stated in the source: $188,000-$245,000, depending on job-related skills and experience.
• Remote-first workforce, with guidance also covering physical offices.