Director, InfoSec & Compliance (SOC 2 + HITRUST)

Pelago Health; New York (NY); Hybrid; USD 210,000 - 230,000; Full time

Benefits offered by this job

Generous equity package

Medical, dental, vision coverage

401k plan

Unlimited PTO and holidays

New parent leave

Flexible working environment

Learning & development stipend

Wellness reimbursement

Reproductive & family planning care

Support for health-related needs

Job summary

Pelago Health is seeking a Director of Information Security & Compliance to lead SOC 2 Type II and HITRUST in a healthcare/regulatory setting. You will craft Pelago's security roadmap, manage audits, and partner with Sales, Engineering, IT, and Legal to accelerate deals while strengthening security.

This is a hands-on leadership role with 3 days/week in our New York office. The role requires cloud security expertise, risk management, and a strong ability to influence cross-functional teams

Qualifications

• Experience leading information security and compliance in healthcare or regulated environments.
• Strong working knowledge of HIPAA requirements.
• Cloud security expertise in a modern stack (AWS, IaC, containers, CI/CD).
• Working knowledge across GRC, security operations, application security, and identity management.

Responsibilities

• Own SOC 2 Type II and HITRUST end-to-end, including audits, remediation and recertification.
• Develop and manage Pelago's security roadmap, budget, tooling, and present risks to executives and Board.
• Lead client security reviews, RFPs, questionnaires and partner due diligence with Sales.
• Maintain security policies and third-party vendor risk reviews, including AI tools.
• Automate evidence collection and implement continuous control monitoring to scale compliance.
• Own incident response, vulnerability management and penetration testing program.
• Partner with Engineering on security monitoring, DR, secure design and AI platform security.
• Partner with IT on IAM and conduct periodic access reviews for audits.
• Collaborate with Legal on privacy programs (HIPAA, GDPR, BAAs) and breach assessments.

Skills

SOC 2 Type II

HITRUST

HIPAA

Cloud security AWS

GRC

IAM

Security operations

Application security

Leadership

Job description

Pelago Health is seeking a Director of Information Security & Compliance to lead SOC 2 Type II and HITRUST in a healthcare/regulatory setting. You will craft Pelago's security roadmap, manage audits, and partner with Sales, Engineering, IT, and Legal to accelerate deals while strengthening security.

This is a hands-on leadership role with 3 days/week in our New York office. The role requires cloud security expertise, risk management, and a strong ability to influence cross-functional teams