Executive VP, Information Security & Risk

The Security Executive Council; United States; On-site; USD 250,000 - 288,500; Full time

Benefits offered by this job

Health, Dental, Vision benefits

401(k) match

Paid time off

Parental leave

Professional development reimbursement

Job summary

Spring Health is seeking a VP, Information Security to define and lead the company's enterprise-wide security strategy, protecting assets and customer data while enabling growth. You will partner with executive leadership across legal, compliance, engineering, and product to embed security into decision-making and scale a high-performing security organization.

You will drive risk management, regulatory compliance (SOC 2, ISO 27001, HIPAA, GDPR), incident response, and cloud security, shaping

Qualifications

• 12+ years of progressive experience in Information Security
• 5+ years in a senior leadership role leading multi-functional security teams
• Ability to communicate security risk to executive and board-level audiences
• Deep working knowledge of HIPAA and hands-on compliance program management
• Experience with HITRUST CSF, SOC 2, ISO 27001, and other security certification programs
• Industry certifications relevant to senior security roles (CISSP, CISM, CCISO, CRISC, CISA)
• Experience owning or contributing to incident response programs and regulatory breach notification obligations
• Strong cloud security, application security, identity and access management skills
• Track record of partnering with executives, auditors, regulators, and customers
• Ability to balance security with customer experience, innovation, and business objectives

Responsibilities

• Develop and execute the enterprise information security vision, strategy, and multi-year roadmap
• Advise executive leadership and the Board on cybersecurity risks, trends, and investments
• Establish security objectives, metrics, and reporting aligned with business priorities
• Drive a security culture with clear risk communications to leadership and the Board
• Own enterprise information security risk management including risk assessments and treatment plans
• Ensure compliance with SOC 2, ISO 27001, HIPAA, HITRUST, PCI DSS, GDPR, and CCPA
• Oversee security audits, policy development, and remediation initiatives
• Manage BAA program across customers and vendors
• Maintain and test Incident Response and Business Continuity programs
• Lead SOC, threat detection, vulnerability management, and incident response
• Embed security in SDLC with threat modeling, secure code review, and automated testing
• Provide guidance for secure cloud infrastructure and product security
• Oversee vulnerability management, penetration testing, and remediation programs
• Build and mentor high-performing security teams; manage budgets and vendor relations
• Partner with Engineering, Legal, Privacy, Product, Sales, IT, HR for security decisions
• Serve as executive contact for cyber insurance underwriters, auditors, and regulators
• Drive continuous improvement of security controls and risk management practices
• Embed security requirements and tooling across development teams
• Ensure enterprise client security questionnaires and audits are efficiently handled
• Demonstrate strong retention in security team leadership

Skills

Security leadership

Risk & compliance

Cloud security

Executive communication

HIPAA/HITRUST knowledge

Security certifications (CISSP/CISM)

Incident response

Vendor risk management

Security architecture

Regulatory audits & standards

Job description

Spring Health is seeking a VP, Information Security to define and lead the company's enterprise-wide security strategy, protecting assets and customer data while enabling growth. You will partner with executive leadership across legal, compliance, engineering, and product to embed security into decision-making and scale a high-performing security organization.

You will drive risk management, regulatory compliance (SOC 2, ISO 27001, HIPAA, GDPR), incident response, and cloud security, shaping