Vice President, Information Security

The Security Executive Council; United States; On-site; USD 250,000 - 288,500; Full time

Benefits offered by this job

Health, Dental, Vision benefits

401(k) match

Paid time off

Parental leave

Professional development reimbursement

Job summary

Spring Health is seeking a VP, Information Security to define and lead the company's enterprise-wide security strategy, protecting assets and customer data while enabling growth. You will partner with executive leadership across legal, compliance, engineering, and product to embed security into decision-making and scale a high-performing security organization.

You will drive risk management, regulatory compliance (SOC 2, ISO 27001, HIPAA, GDPR), incident response, and cloud security, shaping

Qualifications

• 12+ years of progressive experience in Information Security
• 5+ years in a senior leadership role leading multi-functional security teams
• Ability to communicate security risk to executive and board-level audiences
• Deep working knowledge of HIPAA and hands-on compliance program management
• Experience with HITRUST CSF, SOC 2, ISO 27001, and other security certification programs
• Industry certifications relevant to senior security roles (CISSP, CISM, CCISO, CRISC, CISA)
• Experience owning or contributing to incident response programs and regulatory breach notification obligations
• Strong cloud security, application security, identity and access management skills
• Track record of partnering with executives, auditors, regulators, and customers
• Ability to balance security with customer experience, innovation, and business objectives

Responsibilities

• Develop and execute the enterprise information security vision, strategy, and multi-year roadmap
• Advise executive leadership and the Board on cybersecurity risks, trends, and investments
• Establish security objectives, metrics, and reporting aligned with business priorities
• Drive a security culture with clear risk communications to leadership and the Board
• Own enterprise information security risk management including risk assessments and treatment plans
• Ensure compliance with SOC 2, ISO 27001, HIPAA, HITRUST, PCI DSS, GDPR, and CCPA
• Oversee security audits, policy development, and remediation initiatives
• Manage BAA program across customers and vendors
• Maintain and test Incident Response and Business Continuity programs
• Lead SOC, threat detection, vulnerability management, and incident response
• Embed security in SDLC with threat modeling, secure code review, and automated testing
• Provide guidance for secure cloud infrastructure and product security
• Oversee vulnerability management, penetration testing, and remediation programs
• Build and mentor high-performing security teams; manage budgets and vendor relations
• Partner with Engineering, Legal, Privacy, Product, Sales, IT, HR for security decisions
• Serve as executive contact for cyber insurance underwriters, auditors, and regulators
• Drive continuous improvement of security controls and risk management practices
• Embed security requirements and tooling across development teams
• Ensure enterprise client security questionnaires and audits are efficiently handled
• Demonstrate strong retention in security team leadership

Skills

Security leadership

Risk & compliance

Cloud security

Executive communication

HIPAA/HITRUST knowledge

Security certifications (CISSP/CISM)

Incident response

Vendor risk management

Security architecture

Regulatory audits & standards

Job description

About the job

Our mission: eliminating every barrier to mental health.

Spring Health is a global mental health company on a mission to eliminate every barrier to mental health. We're building a world where getting support is simple, personal, and built around the person, so care can continue through every job, move, health plan, and life stage.

Our AI-native platform helps us deliver personalized support across self-guided tools, coaching, therapy, medication management, and specialty care. With outcomes independently validated by JAMA Network Open and the Validation Institute, Spring Health reaches more than 170 million people worldwide through leading employers, health plans, and partners.

As an AI-native company, we believe technology should expand the reach, quality, and humanity of care. Every Spring Health team member is expected to use AI tools thoughtfully, apply human judgment to AI outputs, and keep building AI fluency in ways that support their role and our mission.

The Vice President, Information Security is responsible for defining, leading and advancing the organization's enterprise-wide information security strategy, ensuring the protection of company assets, customer data, and critical systems while enabling business growth and innovation. The leader provides strategic direction across cybersecurity, risk management, compliance, security operations, cloud and application security, identity and access management, third-party risk, and incident response.

The VP, Information Security partners closely with executive leadership, technology, legal, compliance, and business stakeholders to strengthen the organization's security posture, maintain regulatory compliance, and embed security into business and product decision-making. The leader will build and scale a high-performing security organization, drive security program maturity, and ensure the company remains resilient against evolving cyber threats while supporting operational excellence and organizational objectives.

What You'll Do

Security Strategy & Leadership

• Develop and execute the enterprise information security vision, strategy, and multi-year roadmap.
• Serve as a trusted advisor to executive leadership and the Board on cybersecurity risks, trends, and investments.
• Establish security objectives, metrics, and reporting mechanisms aligned with business priorities.
• Drive a security culture across the organization that enables innovation while maintaining appropriate risk controls, including effectively communicating risks and changes in the risk landscape to leadership, the Board, and key stakeholders in clear, business-relevant terms.

Governance, Risk & Compliance

• Own the enterprise information security risk management program, including formal risk assessments, risk registers, and risk treatment plans.
• Ensure compliance with applicable frameworks and regulations, including SOC 2, ISO 27001, HIPAA, HITRUST, PCI DSS, GDPR, and CCPA.
• Oversee security audits, risk assessments, policy development, and remediation initiatives.
• Manage the Business Associate Agreement (BAA) program across the customer and vendor ecosystem.
• Maintain and test the enterprise Incident Response and Business Continuity programs.
• Drive continuous improvement of security controls and risk management practices.

Security Operations & Incident Response

• Oversee security operations, threat detection, vulnerability management, and incident response functions.
• Own the security operations center (SOC) function, including SIEM strategy, threat intelligence, and endpoint detection and response.
• Lead the organization's response to security incidents, including executive communication, regulatory notification obligations, and post-incident review
• Direct penetration testing, security assessments, and resilience exercises.

Cloud, Infrastructure & Product Security

• Partner with Engineering and Product leadership to embed security throughout the software development lifecycle (SDLC), including threat modeling, secure code review, and automated security testing.
• Provide strategic direction for the design and implementation of secure enterprise and cloud infrastructure, ensuring security architecture principles are embedded in platform design, data flows, and technology decisions across the organization.
• Provide security architecture review and guidance for new products, features, and third-party integrations.
• Oversee vulnerability management, penetration testing, and remediation programs across the platform and infrastructure.

Team & Program Leadership

• Build, mentor, and develop high-performing security teams.
• Manage security budgets, technology investments, and vendor relationships.
• Lead third-party risk management and vendor security assessment programs.
• Demonstrated ability to work closely with leadership across the organization, including Engineering, Legal, Privacy, Product, Sales, IT, HR, and others, serving as a trusted partner who enables the business rather than a barrier to it.
• Serve as the executive point of contact for cyber insurance underwriters, external auditors, and regulatory examiners.

What Success Looks Like

• A documented, board-approved information security strategy is in place with defined milestones, KPIs, and accountability.
• Strong regulatory and compliance outcomes, including successful audits and certifications.
• Reduced organizational risk through proactive threat management, vulnerability remediation, and security controls.
• High levels of security resilience demonstrated through effective incident response and crisis management.
• Security is embedded in the SDLC, development teams have clear security requirements, tooling, and a consistent process for security review.
• Enterprise client security questionnaires and audits are handled efficiently, with documented repeatable processes that reduce friction for the Sales and Customer Success teams.
• Meaningful improvements in security awareness and accountability across the organization.
• Executive leadership, customers, partners, and regulators have confidence in the company's security posture.
• A highly engaged, high-performing security team with strong retention

Qualifications:

• 12+ years of progressive experience in Information Security, with at least 5 years in a senior leadership role.
• Demonstrated experience building and leading multi-functional security teams, including risk/compliance, application security, and/or security operations disciplines.
• Demonstrated ability to communicate security risk to executive and board-level audiences, translating technical issues into business and financial impact.
• Deep working knowledge of HIPAA and hands‑on experience managing compliance programs in a covered entity or business associate environment.
• Experience with HITRUST CSF, SOC 2, ISO 27001, and other comparable third‑party security certification programs.
• One or more recognized industry certifications relevant to a role at this level (CISSP, CISM, CCISO, CRISC, or CISA).
• Experience building partnerships across the organization, enabling innovation in a safe and risk‑aware way — a track record of being a business enabler, not a gatekeeper.
• Experience managing client‑facing security responsibilities, including enterprise security reviews, vendor assessments, and RFP responses.
• Experience owning or contributing to incident response programs, including regulatory breach notification obligations.
• Strong working knowledge of cloud security principles and modern SaaS architecture security requirements.
• Track record of partnering effectively with executive leadership, boards, auditors, regulators, and customers.
• Deep knowledge of security operations, threat management, vulnerability management, and incident response.
• Strong expertise in cloud security, application security, identity and access management, and security architecture.
• Strategic mindset with strong business and risk management acumen.
• Ability to balance security requirements with customer experience, innovation, and business objectives.

Compensation:

The target base salary range for this position is $250,000 - $288,500 and is part of a competitive total rewards package including equity and benefits. Individual pay may vary from the target range and is determined by a number of factors including experience, location, internal pay equity, and other relevant business considerations. We review all employee pay and compensation programs annually using Radford Global Compensation Database at minimum to ensure competitive and fair pay.

Benefits Provided by Spring Health

Note: We have even more benefits than listed here and below, your recruiter will provide more in-depth information as you continue in the interview process. Benefits are subject to individual plan requirements and eligibility criteria.

• Health, Dental, Vision benefits start on your first day at Spring. You and your dependents also receive access to One Medical accounts HSA and FSA plans are also available, with Spring contributing up to $1K for HSAs, depending on your plan type.
• Employer sponsored 401(k) match of up to 2% for retirement planning
• A yearly allotment of no cost visits to the Spring Health network of therapists, coaches, and medication management providers for you and your dependents.
• We offer competitive paid time off policies including vacation, sick leave and company holidays.
• At 6 months tenure with Spring, we offer parental leave of 18 weeks for birthing parents and 16 weeks for non-birthing parents.
• Access to Noom, a weight management program—based in psychology, that’s tailored to your unique needs and goals.
• Access to fertility care support through Carrot, in addition to $4,000 reimbursement for related fertility expenses.
• Access to Wellhub, which connects employees to the best options for fitness, mindfulness, nutrition, and sleep in one subscription
• Access to BrightHorizons, which provides sponsored child care, back-up care, and elder care
• Up to $1,000 Professional Development Reimbursement a year.
• $200 per year donation matching to support your favorite causes.

We know how to fine-tune corporate security because we've led effective and efficient Fortune 500-level security programs. The SEC helps businesses find the best balance of risk mitigation, cost and innovation.