Director of Information Security & Compliance (Remote)

Cognito Therapeutics; Cambridge (MA); Hybrid; USD 180,000 - 230,000; Full time

Benefits offered by this job

Unlimited PTO

Wellness benefits

Health, dental, and vision insurance

Job summary

Cognito Therapeutics is building a Security, Privacy, and IT organization from the ground up. The Information Security Director will hire and grow the team, drive SOC 2 and HIPAA audit readiness, and steer toward HITRUST certification under the SVP’s strategic direction.

The role covers policy development, vendor risk management, and acting as the day-to-day security contact in client conversations, with opportunities to shape security strategy and risk governance across the company.

Qualifications

• 10+ years in information security with leadership experience.
• Direct experience running SOC 2 and HIPAA audits.
• Experience building and scaling security teams.
• Familiarity with NIST CSF, ISO 27001, or similar.
• Ability to discuss security posture with executives.

Responsibilities

• Build and lead the Information Security function day-to-day.
• Drive SOC 2 and HIPAA audit readiness end-to-end.
• Work toward HITRUST certification in the future.
• Develop security policies, data protection, and vendor risk controls.
• Serve as the security lead in client and partner diligence.
• Define security KPIs and report to SVP and board as needed.
• Oversee budget and resourcing for the security program.

Skills

Information security leadership

SOC 2 and HIPAA audits

Policy framework development

Vendor risk management

Client/partner security liaison

Security metrics & reporting

Security awareness programs

Education

Bachelor’s degree in Cybersecurity or related field

Job description

Cognito Therapeutics is building a Security, Privacy, and IT organization from the ground up. The Information Security Director will hire and grow the team, drive SOC 2 and HIPAA audit readiness, and steer toward HITRUST certification under the SVP’s strategic direction.

The role covers policy development, vendor risk management, and acting as the day-to-day security contact in client conversations, with opportunities to shape security strategy and risk governance across the company.