Sr Director Information Security

Cognito Therapeutics, Inc.; United States; Remote; USD 160,000 - 230,000; Full time

Benefits offered by this job

Unlimited PTO

Wellness perks

Virtual medical support

Health, dental, and vision insurance

Job summary

Cognito Therapeutics, Inc. is seeking an experienced Information Security Director to build and lead a Security, Privacy, and IT organization from the ground up.

You will drive SOC 2 and HIPAA audit readiness, coordinate with the SVP, and guide policy, risk, and vendor management as the company scales through 2028. You will interact with clients, partners, and the leadership team to define KPIs, report risks, and oversee a security roadmap and budget.

Qualifications

• 10+ years in information security, including leadership at Director level.
• Direct experience running SOC 2 and/or HIPAA audits.
• Comfort as day-to-day technical lead in client/partner discussions.
• Experience building and growing a security team from a small base.
• Experience developing and maintaining a security policy framework.
• Familiarity with NIST CSF, ISO 27001, or similar security controls.

Responsibilities

• Stand up and run Information Security day-to-day and hire the team.
• Drive SOC 2 and HIPAA audit readiness end-to-end, including scoping and evidence collection.
• Build toward HITRUST certification and report progress to SVP.
• Develop and maintain the information security policy set for the organization.
• Establish a vendor security review process for new tools and vendors.
• Serve as security contact in partner and client diligence conversations.
• Hire and ramp the Security team and provide interim leadership as needed.
• Define security KPIs and report to SVP and leadership/board.
• Execute the security roadmap and manage budget with the SVP.

Skills

Information security leadership

SOC 2 audits

HIPAA audits

Vendor risk management

Policy development

Education

Bachelor's degree in Cybersecurity or related field

Job description

This is a rare opportunity to join a team that is bringing an entirely new category of brain health to the world. At Cognito, we are developing therapies designed to promote dignity, clarity, and coherence in the lives they touch.

Cognito is a neurotechnology company developing a new therapeutic approach to cognitive and neurological health, designed to work with the brain's own activity and biology. Born from pioneering neuroscience research at MIT, Cognito brings together neuroscience, engineering, medicine and technology to translate breakthroughs in brain science into practical therapies designed for everyday life.

Our first therapeutic application, Spectris AD, is an investigational, prescription, at-home therapy for Alzheimer's disease. With our pivotal HOPE study now complete, Cognito is entering an important new phase as we advance Spectris AD toward regulatory review, prepare for potential commercialization and continue exploring the broader potential of our science across neurological health.

We are building an interdisciplinary team united by a shared purpose: protecting and progressing the human ability to think, learn and remember. For innovators who want to work at the intersection of breakthrough science, technology and human health, Cognito offers the chance to help shape what comes next.

About The Job

Cognito is building a Security, Privacy, and IT organization from the ground up under the SVP of Security, Privacy, and IT, structured across three functions. The Information Security Director leads the Information Security function day-to-day — hiring and running the team, and driving SOC 2 and HIPAA audit readiness to completion, with HITRUST in the future — under the strategic direction of the SVP, who holds overall executive (CISO-level) accountability for security.

Responsibilities

Build & Lead the Information Security Function

• Stand up and run Information Security day-to-day: hire and manage a team.
• Set team goals and performance expectations as the function grows through 2028.

Certification & Audit Readiness

• Drive SOC 2 and HIPAA audit preparation and execution end-to-end — scoping, control implementation, evidence collection, and auditor coordination.
• Build toward the multi-year HITRUST certification goal, reporting progress and risk up to the SVP.

Policy, Risk & Vendor Management

• Build and maintain the information security policy set (access control, data protection, vendor risk, incident response, etc) that the rest of the team will operate against.
• Establish a vendor security review process for new tools and vendors as the company scales.

Client & Partner Security Support

• Serve as the day-to-day technical security contact in partner and client diligence conversations, escalating to the SVP for executive-level or strategic discussions.

Interim Leadership & Team Growth

• Provide an interim reporting home for the Privacy Analyst, until the Privacy Director is hired.
• Hire and ramp the Security team.

Reporting & Program Execution

• Define security KPIs and report on them regularly to the SVP, and to the broader leadership team or board as needed.
• Execute the security roadmap and budget set together with the SVP, and surface risks, tradeoffs, and resourcing needs as they come up.

Qualifications

Required

• 10+ years in information security, including experience leading a team or sub-function at the Director level.
• Direct experience running SOC 2 and/or HIPAA audits and preparing an organization for certification.
• Comfort operating as the day-to-day technical lead in client/partner diligence conversations.
• Experience building and managing a team from a small base.
• Experience developing and maintaining a security policy framework.
• Familiarity with a recognized security control framework (e.g., NIST CSF, ISO 27001, or similar).

Preferred

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related field
• HITRUST certification experience.
• CISSP, CISM, CRISC, or CISA certifications.
• Experience in a regulated, FDA-adjacent, or medical device environment.
• Prior ownership of vendor/partner risk management or RFP/RFI security response.
• Experience presenting security metrics or risk posture to a leadership team or board.
• Experience running a security awareness training program.

Other

• Remote (USA) position; flexibility required during peak periods, which may include supporting critical operations outside normal business hours as needed.

Competitive Benefits

Taking care of our own is one of our highest priorities. That’s why we offer benefits including unlimited PTO, wellness perks, virtual medical support, and health, dental, and vision insurance.

Physical Requirements & Work Environment

• This role is primarily performed in an office or home-office setting. Essential physical requirements include the ability to work at a computer for extended periods, communicating effectively in written and verbal formats, and participate in video and in-person meetings.
• Occasional travel to partner sites may be required. For remote roles, occasional travel to Cognito’s Cambridge, MA office may also be required.

Cognito Therapeutics is committed to providing reasonable accommodation for qualified individuals with disabilities throughout the application and hiring process. If you require accommodation, please contact us at [e-mail].

Equal Opportunity Employer

Cognito Therapeutics is an Equal Opportunity Employer. We are committed to building a diverse and inclusive workplace and make employment decisions based on qualifications, merit, business needs, and job requirements. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, veteran status, genetic information, or any other characteristic protected by applicable federal, state, or local law.

All applicants must be legally authorized to work in the United States.