Director of Information Security

Charlie Health, Inc.; New York (NY); On-site; USD 200,000 - 250,000; Full time

Job summary

Charlie Health is seeking a Director of Information Security to lead and mature our security program in a highly regulated healthcare setting. You will translate strategy into measurable priorities, grow the security team, and ensure scalable, compliant security across identity, cloud, data protection and governance.

You will partner with IT, Engineering, Compliance and Legal to embed secure-by-design practices, drive incident readiness, and manage risk in a fast-growing organization.

Qualifications

• 10+ years in information security, security engineering or related fields.
• 3+ years leading security teams or major programs.
• Experience building or scaling an enterprise security program.
• Broad technical experience across identity, endpoint, cloud, app security and data protection.
• Strong security architecture, control design, incident response and risk management.
• Experience in regulated environments and translating requirements into controls.
• Familiar with Zero Trust, least privilege and secure-by-design principles.

Responsibilities

• Lead security program priorities, roadmaps and measurable outcomes.
• Develop the Information Security team through hiring, coaching and planning.
• Establish security metrics, rhythms and reporting for risk visibility.
• Provide leadership across security engineering, operations and data protection.
• Embed secure-by-design practices with IT and Engineering to improve controls.
• Oversee incident readiness and response with internal and external partners.
• Ensure HIPAA, SOC 2, NIST compliance and regulatory alignment.
• Identify, assess and prioritize security risk based on business impact.
• Collaborate with Compliance, Legal, Privacy, Product and IT leadership.

Skills

Security leadership

Incident response

Zero Trust

Risk management

Identity security

Cross-functional work

Education

CISSP

CISM

CCSP

Tools

SIEM

MDR

DLP

Job description

Why Charlie Health?

Millions of people across the country are navigating mental health conditions, substance use disorders, and eating disorders, but too often, they’re met with barriers to care. From limited local options and long wait times to treatment that lacks personalization, behavioral healthcare can leave people feeling unseen and unsupported.

Charlie Health exists to change that. Our mission is to connect the world to life-saving behavioral health treatment. We deliver personalized, virtual care rooted in connection - between clients and clinicians, care teams, loved ones, and the communities that support them. By focusing on people with complex needs, we’re expanding access to meaningful care and driving better outcomes from the comfort of home.

As a rapidly growing organization, we’re reaching more communities every day and building a team that’s redefining what behavioral health treatment can look like. If you're ready to use your skills to drive lasting change and help more people access the care they deserve, we’d love to meet you.

About the Role

The Director of Information Security is responsible for leading the execution and continued maturity of Charlie Health’s information security program. Reporting to the VP of IT & CISO, this role will lead the Information Security team, translate security strategy into measurable outcomes and ensure security capabilities scale with the business.

This role requires broad leadership experience across security engineering, security operations, governance, risk, compliance, identity, cloud security, application security and data protection. The Director will work closely with IT, Engineering, Compliance, Legal, Privacy, Product and business leadership to reduce risk while enabling Charlie Health to move quickly and safely.

Charlie Health operates in a highly regulated healthcare environment. This role will help ensure security capabilities align with HIPAA, SOC 2, NIST, Zero Trust principles and other applicable regulatory and contractual requirements.

Key Responsibilities

Security Program Leadership

• Translate CISO and executive strategy into clear priorities, roadmaps and measurable security outcomes
• Lead and develop the Information Security team, including hiring, coaching, performance management and organizational planning
• Establish security metrics, operating rhythms and reporting that provide clear visibility into risk, control maturity and program performance

Security Engineering & Operations

• Provide leadership across security engineering, architecture, security operations, incident response, identity, cloud, application security and data protection
• Partner with IT and Engineering to embed secure-by-design practices, automation and modern engineering practices that improve control effectiveness, consistency and operational efficiency
• Lead security incident readiness and response, including coordination with internal teams, managed security providers and external partners

Governance, Risk & Business Partnership

• Lead operational security capabilities supporting HIPAA, SOC 2, NIST and other applicable requirements
• Identify, assess and prioritize security risk based on business impact, materiality and organizational priorities
• Partner with leaders across Compliance, Legal, Privacy, Product, IT and Engineering to integrate security into business and technology decisions

Required Qualifications

• 10+ years of progressive experience in information security, security engineering, security operations or related disciplines
• 3+ years of experience leading security teams or major security programs
• Demonstrated experience building, scaling or materially improving an enterprise information security program
• Broad technical experience across multiple security domains including identity, endpoint, SaaS, cloud, application security, security operations and data protection
• Strong understanding of security architecture, control design, incident response and risk management
• Experience operating in a regulated environment and translating regulatory requirements into practical controls
• Strong understanding of Zero Trust, least privilege, identity-centric security and secure-by-design principles
• Strong leadership, communication, judgement and cross-functional collaboration skills
• Ability to operate effectively in a high-growth environment with significant change and competing priorities
• You live within a 75-minute commute of our NYC office (near Union Square) and are able to work in-office 4 days per week

Preferred Qualifications

• Experience in healthcare, financial services or another highly regulated industry
• Experience supporting HIPAA, SOC 2, NIST, ISO 27001 or similar frameworks
• Experience leading multidisciplinary security teams
• Experience with enterprise identity, endpoint, cloud, SIEM, MDR, DLP and application security platforms
• Experience securing enterprise AI tools, LLM platforms or AI-enabled workflows
• Relevant certifications such as CISSP, CISM, CCSP or equivalent experience

Benefits

Charlie Health is pleased to offer comprehensive benefits to all full-time, exempt employees.

Read more about our benefits here.

Additional Information

The total target base compensation for this role will be between 200,000 - $250,000 per year at the commencement of employment. In addition to base compensation, this role also offers a performance bonus. Please note, pay will be determined on an individualized basis and will be impacted by location, experience, expertise, internal pay equity, and other relevant business considerations. Further, cash compensation is only part of the total compensation package, which, depending on the position, may include stock options and other Charlie Health-sponsored benefits.

Our Values

• Connection: Care deeply & inspire hope.
• Congruence: Stay curious & heed the evidence.
• Commitment: Act with urgency & don’t give up.

Equality & Diversity

At Charlie Health, we value being an Equal Opportunity Employer. We strive to cultivate an environment where individuals can be their authentic selves. Being an Equal Opportunity Employer means every member of our team feels as though they are supported and belong. We value diverse perspectives to help us provide essential mental health and substance use disorder treatments to all young people.

Charlie Health applicants are assessed solely on their qualifications for the role, without regard to disability or need for accommodation.