Head of Information Security

Grayson Search Partners; Nashville (TN); On-site; USD 120,000 - 150,000; Full time

Job summary

A leading IT recruitment firm is seeking a Head of Information Security to lead the cybersecurity strategy for a Healthcare Benefits Administrator. The role involves developing security protocols, leading IT security operations, and ensuring compliance with industry regulations. Candidates should have a strong background in IT risk management and hold relevant certifications, such as CISSP. This position is full-time in Nashville, Tennessee and requires strategic leadership skills.

Qualifications

• 5-7 years of progressive experience in IT infrastructure and cybersecurity operations.
• Professional certifications: CISSP required; CISM preferred.
• Proven experience securing hybrid environments including AWS and Azure.

Responsibilities

• Develop and implement enterprise-wide information security strategy.
• Lead day-to-day IT security operations and incident response.
• Align security controls with enterprise architecture.

Skills

Cybersecurity operations

IT risk management

Leadership

Incident response

Cloud security

Education

Bachelor’s degree in Information Security or related field

Master’s degree in Business or Technology

Tools

SIEM

EDR/MDR

Vulnerability scanning tools

Job description

Get AI-powered advice on this job and more exclusive features.

The Head of Information Security will lead the organization’s cybersecurity and IT risk management program, ensuring the confidentiality, integrity, and availability of enterprise systems, data, and services. This role is accountable for building and executing a comprehensive security strategy aligned to business goals, industry best practices, and regulatory requirements for a Healthcare Benefits Administrator business with multiple U.S. locations and offshore employees. Reporting to the CTO (or equivalent executive), this leader will oversee all aspects of IT security operations, governance, and compliance while fostering a strong culture of security awareness across the enterprise.

Key Responsibilities:

Strategic Leadership

• Develop, implement, and continuously improve an enterprise-wide information security and IT risk management strategy aligned to organizational objectives.
• Advise executive leadership and the Board on security posture, emerging threats, and resource investments.
• Integrate security into business processes, product development, and IT operations, including DevSecOps practices.
• Establish and maintain security policies, standards, and procedures in accordance with frameworks such as ISO 27001, NIST, CIS, PCI, HIPAA.

Security Operations

• Lead day-to-day IT security operations, including configuration, monitoring, analysis, and troubleshooting of security systems and services.
• Oversee 24x7 monitoring, incident detection, and response activities.
• Serve as the primary escalation point for security events, coordinating containment, investigation, and post-incident reviews.
• Implement and manage threat detection tools (e.g., SIEM, EDR/MDR), vulnerability scanning, and automated security testing.
• Conduct enterprise risk assessments and develop mitigation strategies.
• Ensure compliance with federal, state, and industry regulations governing PII, PHI, and other sensitive data.
• Coordinate security audits, vendor risk assessments, and penetration testing.
• Maintain cyber insurance coverage and incident response plans.

Governance & Program Management

• Align security controls with enterprise architecture, cloud computing standards, and hybrid infrastructure security principles.
• Lead cybersecurity projects from concept through implementation and post-production support.
• Track and manage security budgets, ensuring cost-effective solutions.
• Manage vendor relationships, contract negotiations, and service performance reviews.

Team Development & Culture

• Build and lead a hybrid cybersecurity program and team
• Provide technical consultation and training to IT and business teams on secure design and operational practices.
• Foster a culture of security awareness through organization-wide training programs.

Required Qualifications

• Bachelor’s degree in Information Security, Information Technology, or related field; Master’s degree in Business or Technology preferred.
• 5-7 years of progressive experience in IT infrastructure, cybersecurity operations, and risk management, including leadership roles.
• Professional certifications: CISSP required; CISM preferred; ITIL and other security-related certifications a plus.
• Proven experience securing hybrid environments, including AWS, Azure, and private cloud.
• Strong knowledge of security tools and technologies: SIEM, DLP, MFA, EDR/MDR, MDM, vulnerability scanning, firewall management, and email/web filtering.
• Demonstrated ability to translate complex technical risks into actionable business decisions.

Desired Competencies

• Strategic vision with the ability to balance security, operational, and business priorities.
• Excellent leadership, communication, and relationship-building skills across technical and non-technical stakeholders.
• Strong problem-solving skills with the ability to act decisively in high-pressure situations.
• Experience in regulated industries, preferably insurance, healthcare, or financial services.

Compliance & Regulatory Competencies

• Adherence to HIPAA, PCI requirements.
• Strong understanding of third-party risk management and vendor due diligence.
• Implementation of controls for multi-jurisdictional data privacy and security laws.

Seniority level

Director

Employment type

Full-time

Job function

Information Technology