Hybrid Director, Cybersecurity & GRC

Duly Health and Care; Downers Grove (IL); Hybrid; USD 136,000 - 180,000; Full time

Benefits offered by this job

Medical, dental, vision

Mental health support

Life & disability insurance

Tuition reimbursement

401(k) match

Volunteer time off

Parental leave

Job summary

Duly Health and Care is seeking a Director of Information Security & Governance to lead our enterprise security, GRC, and incident response efforts in a hybrid, full-time role. Reporting to the CTO, you will protect patient data and clinical systems across a large healthcare network.

You will manage a team of security architects, define strategy, drive regulatory compliance (HIPAA/HITECH, NIST), and partner with Legal and Compliance to embed security in programs and workflows.

Qualifications

• 10+ years in information security with leadership experience.
• Deep knowledge of GRC, policy, risk, and regulatory compliance.
• Healthcare security experience including HIPAA/HITECH.

Responsibilities

• Lead and develop a security team of architects and specialists.
• Define enterprise cybersecurity strategy aligned with executive vision.
• Oversee security architecture for enterprise systems and cloud.
• Drive threat detection, incident response, and vulnerability management.
• Oversee GRC program, audits, and third-party risk assessments.

Skills

Information security leadership

GRC management

HIPAA/HITECH security

Risk management

Executive communication

Security architectures

Education

Bachelor's in Cybersecurity/IS/CS

Master's degree (preferred)

Job description

Duly Health and Care is seeking a Director of Information Security & Governance to lead our enterprise security, GRC, and incident response efforts in a hybrid, full-time role. Reporting to the CTO, you will protect patient data and clinical systems across a large healthcare network.

You will manage a team of security architects, define strategy, drive regulatory compliance (HIPAA/HITECH, NIST), and partner with Legal and Compliance to embed security in programs and workflows.