Sr Director Information Security

Cognito Therapeutics; United States; Remote; USD 180,000 - 240,000; Full time

Job summary

Cognito Therapeutics is building a Security, Privacy, and IT organization from the ground up under the SVP of Security, Privacy, and IT. The Information Security Director will lead the function day-to-day, hire and manage the team, and drive SOC 2 and HIPAA audit readiness with an eye toward HITRUST in the future.

Responsibilities include standing up and leading the information security program, developing policy, managing vendor risk, supporting client and partner security diligence, and

Qualifications

• 10+ years in information security, including experience leading a team or sub-function at the Director level.
• Direct experience running SOC 2 and/or HIPAA audits and preparing an organization for certification.
• Comfort operating as the day-to-day technical lead in client/partner diligence conversations.
• Experience building and managing a team from a small base.
• Experience developing and maintaining a security policy framework.
• Familiarity with a recognized security control framework (e.g., NIST CSF, ISO 27001, or similar).

Responsibilities

• Build & Lead the Information Security Function: stand up and run Information Security day-to-day; hire and manage a team.
• Certification & Audit Readiness: drive SOC 2 and HIPAA audit prep and execution end-to-end; progress toward HITRUST.
• Policy, Risk & Vendor Management: establish security policy set and vendor review processes.
• Client & Partner Security Support: serve as day-to-day security contact in diligence conversations.
• Interim Leadership & Team Growth: provide interim reporting home for Privacy Analyst; hire and ramp security team.
• Reporting & Program Execution: define security KPIs; execute roadmap and surface risks.

Skills

Security leadership

SOC 2 audits

HIPAA audits

Policy framework

Vendor risk management

Client diligence

Regulatory familiarity

Security metrics

Security training

Education

Bachelor’s degree in Cybersecurity

Bachelor’s degree in related field

Tools

NIST CSF familiarity

ISO 27001 familiarity

Job description

This is a rare opportunity to join a team that is bringing an entirely new category of brain health to the world. At Cognito, we are developing therapies designed to promote dignity, clarity, and coherence in the lives they touch.

Cognito is a neurotechnology company developing a new therapeutic approach to cognitive and neurological health, designed to work with the brain's own activity and biology. Born from pioneering neuroscience research at MIT, Cognito brings together neuroscience, engineering, medicine and technology to translate breakthroughs in brain science into practical therapies designed for everyday life.

Our first therapeutic application, Spectris AD, is an investigational, prescription, at-home therapy for Alzheimer's disease. With our pivotal HOPE study now complete, Cognito is entering an important new phase as we advance Spectris AD toward regulatory review, prepare for potential commercialization and continue exploring the broader potential of our science across neurological health.

We are building an interdisciplinary team united by a shared purpose: protecting and progressing the human ability to think, learn and remember. For innovators who want to work at the intersection of breakthrough science, technology and human health, Cognito offers the chance to help shape what comes next.

About the Job

Cognito is building a Security, Privacy, and IT organization from the ground up under the SVP of Security, Privacy, and IT, structured across three functions. The Information Security Director leads the Information Security function day-to-day - hiring and running the team, and driving SOC 2 and HIPAA audit readiness to completion, with HITRUST in the future - under the strategic direction of the SVP, who holds overall executive (CISO-level) accountability for security.

Responsibilities

Build & Lead the Information Security Function

• Stand up and run Information Security day-to-day: hire and manage a team.

• Set team goals and performance expectations as the function grows through 2028.

Certification & Audit Readiness

• Drive SOC 2 and HIPAA audit preparation and execution end-to-end - scoping, control implementation, evidence collection, and auditor coordination.

• Build toward the multi-year HITRUST certification goal, reporting progress and risk up to the SVP.

Policy, Risk & Vendor Management

• Build and maintain the information security policy set (access control, data protection, vendor risk, incident response, etc) that the rest of the team will operate against.

• Establish a vendor security review process for new tools and vendors as the company scales.

Client & Partner Security Support

• Serve as the day-to-day technical security contact in partner and client diligence conversations, escalating to the SVP for executive-level or strategic discussions.

Interim Leadership & Team Growth

• Provide an interim reporting home for the Privacy Analyst, until the Privacy Director is hired.

• Hire and ramp the Security team.

Reporting & Program Execution

• Define security KPIs and report on them regularly to the SVP, and to the broader leadership team or board as needed.

• Execute the security roadmap and budget set together with the SVP, and surface risks, tradeoffs, and resourcing needs as they come up.

Qualifications

Required

• 10+ years in information security, including experience leading a team or sub-function at the Director level.

• Direct experience running SOC 2 and/or HIPAA audits and preparing an organization for certification.

• Comfort operating as the day-to-day technical lead in client/partner diligence conversations.

• Experience building and managing a team from a small base.

• Experience developing and maintaining a security policy framework.

• Familiarity with a recognized security control framework (e.g., NIST CSF, ISO 27001, or similar).

Preferred

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related field

• HITRUST certification experience.

• CISSP, CISM, CRISC, or CISA certifications.

• Experience in a regulated, FDA-adjacent, or medical device environment.

• Prior ownership of vendor/partner risk management or RFP/RFI security response.

• Experience presenting security metrics or risk posture to a leadership team or board.

• Experience running a security awareness training program.

Other

• Remote (USA) position; flexibility required during peak periods, which may include supporting critical operations outside normal business hours as needed.

Competitive Benefits

Taking care of our own is one of our highest priorities. That's why we offer benefits including unlimited PTO, wellness perks, virtual medical support, and health, dental, and vision insurance.

Physical Requirements & Work Environment

This role is primarily performed in an office or home-office setting. Essential physical requirements include the ability to work at a computer for extended periods, communicating effectively in written and verbal formats, and participate in video and in-person meetings.

Occasional travel to partner sites may be required. For remote roles, occasional travel to Cognito's Cambridge, MA office may also be required.

Cognito Therapeutics is committed to providing reasonable accommodation for qualified individuals with disabilities throughout the application and hiring process. If you require accommodation, please contact us at [e-mail].

Cognito Therapeutics is an Equal Opportunity Employer. We are committed to building a diverse and inclusive workplace and make employment decisions based on qualifications, merit, business needs, and job requirements. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, veteran status, genetic information, or any other characteristic protected by applicable federal, state, or local law.

All applicants must be legally authorized to work in the United States.