Head of Information Security

Help at Home; Denver (CO); On-site; USD 220,000 - 250,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

401(k) retirement plan

Paid time off & holidays

Employee assistance programs

Wellness initiatives

Flexible options to support balance

Job summary

Help at Home is seeking a Head of Information Security to lead the company’s enterprise-wide security program from Denver, CO. This executive role drives governance, risk management, security operations, and regulatory compliance, partnering with IT, Legal, Finance, and senior leaders to strengthen controls and resilience.

The ideal candidate has 12+ years in information security with 3+ years in leadership, hands-on incident response, and expertise in SOX, ITGC, and vendor management.

Qualifications

• Bachelor’s degree in CS/IT/Cybersecurity or related field.
• 12+ years of information security experience.
• 3+ years leading security teams.
• Hands-on security operations including incident response.
• Experience with MSSP/vendor management.
• SOX/ITGC remediation experience.
• Knowledge of NIST, ISO 27001, SOC 2, CIS Controls.
• AI governance knowledge helpful.

Responsibilities

• Lead enterprise security program, including governance, risk management, and security operations.
• Oversee security metrics, KPIs, and reporting to executives and Board.
• Manage third‑party security providers and vendor relationships.
• Lead incident response planning and crisis management readiness.
• Ensure security requirements across SDLC and vendor relationships.
• Support SOX, ITGC, and audit readiness and remediation.

Skills

Security leadership

12+ years information security

3+ years leading teams

Incident response

Vulnerability management

MSSP/vendor management

AI governance

Cloud security

Education

Bachelor's degree in CS/IT/Cybersecurity or related field

Tools

SIEM

EDR/XDR

IAM

DLP

Job description

Overview

Help at Home is the leading national provider of in-home personal care services, where our mission is to enable individuals to live with independence and dignity at home. Our team supports 66,000 clients monthly with the help of 50,000 compassionate caregivers across 12 states. We’re looking for people who care about others, who are willing to listen, lean in and make impactful change. Each role at Help at Home can have a positive impact in supporting our caregivers and clients. If you are someone who leads with passion and integrity and are looking to join a rapidly growing, industry leading team, Help at Home may be a good fit for you.

The Head of Information Security is responsible for leading and advancing Help at Home’s enterprise-wide information security program. This hands‑on leadership role oversees security operations, cybersecurity strategy execution, risk management, and regulatory compliance initiatives to protect company systems, data, and business operations. The Head of Information Security partners closely with Information Technology, Finance, Legal, Compliance, Privacy, Procurement, Internal Audit, and senior business leaders to strengthen security controls, enhance organizational resilience, and foster a culture of security awareness. This position serves as a trusted advisor to executive leadership, providing strategic guidance on emerging threats, risk mitigation, and the continued maturity of the organization’s cybersecurity program.

Our Benefits:

• Comprehensive medical, dental, and vision coverage
• 401(k) retirement plan
• Paid time off and holidays
• Employee assistance programs and wellness initiatives
• Flexible options to support a balanced life

Responsibilities

Essential Duties and Responsibilities

• Program Leadership
• Own execution of the enterprise security strategy and roadmap, translating strategic direction into operating plans, priorities, and measurable outcomes.
• Lead and operate the day-to-day security program, including governance, risk management, security operations, and program metrics.
• Establish and maintain meaningful security metrics, key risk indicators, and reporting to support decision-making and transparency.
• Monitor emerging threats, legislation, and industry developments; assess risk exposure and drive timely mitigation.
• Security Operations and Team Leadership
• Own day-to-day security operations, including monitoring and detection, vulnerability management, security engineering, and incident response.
• Lead, hire, and develop the security team, including resource planning, coaching, and prioritization of work against business‑critical objectives.
• Manage relationships with MSSPs, tooling partners, and other third‑party security providers and ensure vendor performance meets expectations.
• Oversee identity and access management, cloud security, application security, and data protection programs.
• Ensure security participation in the software development lifecycle and embed security requirements into products, platforms, and vendor relationships.
• Policy and AI Governance
• Maintain and update security policies, standards, and procedures, including policies governing the responsible use of AI.
• Participate in enterprise AI governance, partnering with IT, Legal, Compliance, and business leaders to assess AI use cases, define acceptable use, and manage data, model, and third‑party AI risk.
• SOX, Audit, and Compliance
• Partner with Finance, IT, and Internal Audit to remediate material weaknesses and strengthen IT general controls, including access management and change management.
• Own the security‑related control environment and evidence and support internal and external audit, certification, and customer assurance activities.
• Ensure alignment with applicable regulatory requirements, including HIPAA and SOX, and recognized frameworks such as NIST CSF, ISO 27001, SOC 2, or CIS Controls.
• Cyber Resilience and Business Continuity
• Lead business continuity planning (BCP) and disaster recovery alignment, working directly with business stakeholders to define critical processes, recovery objectives, and response plans.
• Lead incident response and crisis management readiness, including tabletop exercises and post‑incident improvement.
• Risk and Third‑Party Management
• Support enterprise cyber risk management, including risk identification, assessment, mitigation, and monitoring.
• Oversee third‑party and vendor security risk assessments.
• Support security due diligence for mergers, acquisitions, and integrations.
• Stakeholder and Leadership Communication
• Act as a trusted security resource for business and technology leaders, translating technical risk into clear, practical recommendations.
• Prepare and help present security materials for executive leadership and, as needed, the Board.
• Build working relationships with regulators, industry groups, and external security partners as needed.
• Lead cybersecurity awareness, education, and culture initiatives across the enterprise.

Qualifications

Required Skills/Abilities

• Strong business acumen and the ability to frame information security as a business issue.
• Hands‑on leadership style with strong technical depth.
• Ability to lead a team through rapid change and competing priorities.
• Ability to influence others where there is no direct authority.
• Ability to propose creative, practical solutions to security‑specific business problems.
• Proven record of meeting operational objectives and earning the respect of the organization through results.
• Ability to translate cyber risk and technical concepts into clear recommendations for business and technology leaders.
• Strong communication skills with technical and non‑technical audiences.
• Demonstrated ownership, accountability, teamwork, and cross‑functional collaboration.

Security Responsibilities

All employees must follow Help at Home cybersecurity and privacy policies, protect sensitive data, complete required training, and report suspected incidents. They must also follow acceptable use and access requirements and use only authorized systems.

Education and Experience

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent relevant experience required.
• 12+ years of experience in information security, including 3+ years leading security teams, programs, or cross‑functional security initiatives required.
• Hands‑on experience running security operations, including incident response and vulnerability management, and managing MSSP or vendor partners required.
• Experience remediating SOX / ITGC control deficiencies or material weaknesses required.
• Experience developing and running BCP/DR programs with non‑technical business stakeholders required.
• Experience maintaining and updating security policy, including emerging areas such as AI usage required.
• Working knowledge of security and compliance frameworks such as NIST, ISO 27001, SOC 2, or CIS Controls required.
• Security certification such as CISSP, CISM, CISA, CRISC, or CCSP preferred.
• Healthcare or other highly regulated industry experience preferred.
• Experience in a public-company or SOX‑regulated environment preferred.
• Experience with AI governance frameworks, such as NIST AI RMF, preferred.
• Experience with cloud security (AWS, Azure, GCP, or hybrid) and enterprise security technologies such as SIEM, EDR/XDR, IAM, and DLP preferred.
• Experience supporting M&A security integration preferred.
• Experience leading tabletop exercises, penetration testing, or red team/blue team activities preferred.

Pay Range

USD $220,000.00 - USD $250,000.00 /Yr.