Chief Information Security Officer

As Qualified Health scales its AI platform across leading health systems and pharmaceutical sponsors, security is fundamental to protecting sensitive data, earning customer trust, and deploying AI responsibly in healthcare. As the Chief Information Security Officer (CISO), you will own the enterprise security strategy, risk posture, and security and privacy program end to end. This is an executive leadership role that combines strategic ownership with technical depth.

Responsibilities

Own enterprise security strategy, risk posture, and roadmap, aligning priorities and investments with business objectives and the evolving threat landscape; Advise executive leadership on material risks, risk acceptance decisions, security investments, and the implications of new products and customer engagements; Establish security governance, policies, metrics, and accountability across the organization; Build out and scale the security organization, determining the right mix of internal expertise, external partners, and essential capabilities; Set technical security direction across application security, cloud infrastructure, identity and access management, vulnerability management, and secure software development; Partner with Engineering and Product to embed security into architecture, development, testing, deployment, and production operations; Establish safeguards for AI-enabled products and workflows, including protection of PHI across LLM integrations, AI agents, data pipelines, and connected systems; Work directly with engineering leaders to resolve high-impact technical risks while balancing security rigor with product velocity; Provide strategic direction and technical leadership in the design and implementation of a secure AI infrastructure; Oversee DevOps and cloud infrastructure during the current growth phase, ensuring reliable, scalable, and secure platform operations; Own the security program supporting HITRUST, SOC 2, and applicable customer and regulatory requirements, including control design, audit readiness, and ongoing effectiveness; Partner with Legal, Privacy, Engineering, and business leaders to translate contractual and regulatory obligations into practical controls; Serve as the senior security counterpart to health system and pharmaceutical customers, leading security diligence, technical assessments, and escalations; Partner with Commercial and Customer Success to resolve security-related deal blockers; Evaluate third-party and vendor risks, and determine when additional frameworks or certifications are warranted; Own the security incident response program, including detection, escalation, investigation, containment, recovery, and post-incident remediation; Establish and test incident response, business continuity, and disaster recovery plans; Support the Privacy Team in meeting HIPAA and state privacy law reporting obligations; Build the operating model, tools, processes, and external partnerships needed to maintain effective security operations; Drive security awareness and clear security ownership across Engineering, IT, and other business functions

Requirements

12+ years of experience in information security or cybersecurity, including significant leadership experience at enterprise or high-growth technology companies; Experience operating at CISO, VP of Security, or equivalent senior leadership level, with accountability for enterprise security strategy, risk management, and executive engagement; Track record of building and scaling security programs, including foundational controls, governance, technical capabilities, and teams; Deep technical understanding of cloud security, application security, identity and access management, vulnerability management, and incident response; Experience owning or leading HIPAA and SOC 2 program success, including control implementation, audit readiness, and remediation; Experience protecting sensitive or regulated data and translating compliance requirements into effective technical controls; Experience leading enterprise customer security reviews and communicating security posture and risk to senior stakeholders; Ability to influence executive leadership and cross-functional teams while balancing risk management with business priorities

Nice to have

Experience at a high-growth healthcare technology, healthcare AI, life sciences technology, or enterprise SaaS company; Experience securing AI-enabled applications, LLM-based systems, AI agents, or platforms handling sensitive healthcare data; Experience with HITRUST, NIST Cybersecurity Framework, or NIST AI Risk Management Framework; Experience presenting security posture, material risks, and investment recommendations to a board or board-level committee; Hands-on experience leading or working closely with DevOps, SRE, or platform engineering teams; Relevant certifications such as CISSP, CISM, or CCSP

Benefits

Competitive salaries with equity packages; Robust medical, dental, and vision insurance; Flexible working hours; Hybrid work options; Inclusive environment that fosters creativity and innovation