← Back to opportunities
C
Full-time

Director, Information Security

Carrot · Global · Remote
Pay
$188K–$245K / yr
Apply on company site
About the role

Carrot is seeking a Director of Information Security to lead the security program protecting sensitive fertility and family-building data globally. The role balances setting security strategy with hands-on execution: prioritizing risk, guiding audit and certification cycles, coaching a small team, and engaging with customers. Carrot has earned SOC 2 Type II, HIPAA, HITRUST, and PCI DSS compliance. The director will work with executive leadership and engineering to build security into product design, operations, and sales processes for a healthcare platform at scale.

What you'll do
  • •Lead Carrot's security strategy and roadmap using recognized maturity models to prioritize investments and report progress to executive leadership
  • •Own the full security program across corporate security (GRC, incident management, security awareness, third-party risk) and product security
  • •Partner with Engineering to build security into design, shipping, and operations
  • •Own the compliance portfolio including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA
  • •Direct incident response readiness including playbooks, tabletop exercises, and executive communication
  • •Represent Carrot's security posture to employers, health plans, and health systems through reviews and strategic conversations
What they're looking for
  • •Bachelor's degree in Computer Science, Information Technology, or related field (or equivalent experience)
  • •10+ years of experience in technology, including 5+ years in information security and at least 3 years leading security teams
  • •Security certification such as CISSP or CISM
  • •Experience leading the security function at a late-stage startup, scale-up, or public company
  • •Working depth in healthcare data protection and privacy frameworks including HIPAA, GDPR, and CCPA/CPRA
  • •Experience overseeing enterprise frameworks and audits such as SOC 2 Type II, HITRUST, PCI DSS, and ISO 27001
Skills
Information Security LeadershipHealthcare Data Protection and Privacy (Application, Network, and Cloud SecurityNIST CSF and OWASP FrameworksIncident Response and Risk ManagementSOC 2, HITRUST, PCI DSS, ISO 27001 ComplBudget Management and Vendor RelationshiExecutive-Level Communication

Found on weworkremotely.com. Link checked Nov 9. Marquee links to the company's own application. We are not the employer.