Vice President, Information Security

Stellar Health is seeking a Vice President, Information Security to lead and evolve the company's security program. The VP will own the full scope of information security strategy, operations, governance, and budget, report to the Chief Compliance Officer (CCO), and partner with the Chief Technology Officer and cross-functional leaders. The role leads and manages a small team, with the opportunity to grow in line with business needs. The mandate is to scale the security function, redesign its operating model where growth demands it, drive security governance, define a multi-year security roadmap, navigate the security implications of Stellar's AI capabilities, and maintain customer and patient trust. The role operates at the intersection of healthcare regulation, enterprise information security, and product innovation, and serves as the executive security counterpart to customer CISOs and security leadership.

Responsibilities

Own Stellar's enterprise security strategy, aligning it with business objectives, regulatory obligations, and customer expectations; Serve as the senior security voice, providing regular reporting to the CCO and executive leadership on AI and traditional risk postures, program maturity, investment priorities, and emerging threats; Provide the security expertise behind the CCO's reporting to the Board; Lead the continued evolution of Stellar's threat-based risk model; Own the security budget and resource allocation, tying spend to risk reduction and to the revenue that security enables; Set the security standards for cloud security, application security, endpoint protection, and identity and access management, and be accountable for meeting them; Stay hands-on, including security architecture reviews, risk assessments, incident response, and customer security reviews; Own third-party and cyber risk management, including setting the security standard for vendors with access to PHI and managing the cyber insurance program in coordination with Finance and Legal; Own incident response and business continuity readiness, including regular testing, and lead the security response when an incident occurs; Lead security due diligence for strategic partnerships, new payor relationships, and potential acquisitions; Serve as Stellar's security counterpart in customer relationships, leading security reviews and responding to enterprise due diligence requests; Ensure the security program satisfies federal and state security and privacy laws; Lead security-side preparation for HITRUST audits and manage remediation of findings; Stay ahead of evolving regulatory requirements, including AI governance frameworks and state-level health data privacy laws; Develop Stellar's position on responsible AI security practices and partner with Engineering and Product to establish and enforce security guardrails for AI initiatives; Set and enforce the security standard for AI tools adopted across the organization, with authority to approve or restrict tools; Design the security function's operating model and organizational structure, and hire, develop, and lead a team with depth in cloud security, application security, and healthcare-specific compliance; Build a security-aware culture through training and embedded partnerships with Engineering and Product; Define what success looks like for the security function and report measurable progress against it

Requirements

13+ years of progressive experience in information security, with at least 5 years in a senior leadership role (Senior Director or above) owning security strategy and/or operations in a software product organization; Deep expertise in healthcare or health-tech security, with hands-on experience navigating HIPAA, HITRUST, and the regulatory dynamics unique to companies that handle PHI and payor data; Demonstrated experience with threat-based or risk-based security frameworks, with a philosophy grounded in risk mitigation rather than risk elimination; Proven people-management experience hiring, developing, and leading a small, high-performing security team in a high-growth software product environment, and scaling it in line with business needs; Strong executive presence with a track record of influencing peers, presenting to boards of directors, and speaking with existing and potential customers; Experience managing security in SaaS-first, cloud-native environments (AWS preferred); Demonstrated ability to personally adopt AI tools and lead AI adoption across a team, with measurable productivity gains and a mindset toward leveraging emerging technology to scale security operations; Depth in AI/ML security, including data governance, model security, and third-party AI risk assessment; Strong problem-solving skills and the credibility to disagree with senior executives, hold the line on risk, and still reach alignment; Ability to lead through influence and manage key senior stakeholders across Engineering, Product, Finance, Legal, People, and Compliance; Experience owning a security budget and making resource allocation decisions that balance risk reduction with business investment; Demonstrated ability to lead security due diligence for M&A, strategic partnerships, and new business line launches, with experience recommending remediation paths and explaining the business impact of risks discovered

Nice to have

CISSP, CISM, or similar certifications; HITRUST Certified CSF Practitioner (CCSFP); HITRUST audit management experience; Experience with CMS data handling requirements and government payor security expectations

Benefits

Medical, Dental and Vision Benefits; Flexible PTO; Universal Paid Family and Caregiver Leave; Wellhub+ Gym Memberships; Pre-tax commuter benefits, HA, FSA plans; Company sponsored One Medical memberships and Citibike memberships; Medical Travel Benefits; JOON flexible lifestyse spending account with a monthly stipend; Stock Options; 401k matching program; Company sponsored social events for in-office and remote employees; Company sponsored lunch for all NY HQ employees