Chief Information Security Officer (CISO)

Insurity's Next Chief Information Security Officer (CISO) Insurity is seeking a strategic, operational, and technically credible Chief Information Security Officer to lead Insurity's enterprise security, cybersecurity risk and privacy programs. The CISO will protect Insurity's information assets, products, customer environments, and technology ecosystem while enabling growth, cloud adoption, international expansion, and responsible use of artificial intelligence. This leader will translate cybersecurity, privacy, compliance, and technology risk into clear business decisions for executive leadership and the Board. The successful candidate will combine executive presence with practical execution. They need to be comfortable setting strategy, leading through influence, engaging with customers executives and regulators, directing major incidents, reviewing architecture, and building the processes, team, and culture required for a growing SaaS company. What Our Chief Information Security Officer (CISO) Will Do Enterprise security strategy and governance • Develop, implement, and continuously improve Insurity's enterprise information security strategy, policies, standards, and control framework. • Establish security priorities that align with business strategy, product roadmaps, customer commitments, and the organization's risk appetite. • Reinforce an enterprise security governance structure, including executive steering forums and appropriate reporting to the executive team and Board of Directors. • Define clear accountability for security across Engineering, Product, Corporate IT, Cloud Operations, Legal, Privacy, and Compliance business functions. • Provide risk-mitigating direction for initiatives with technology, data, cloud, product, or customer-security implications. • Maintain a forward-looking view of emerging threats, technologies, regulations, and business risks. HIPAA, PHI data protection • Own and mature Insurity's HIPAA compliance and electronic protected health information program where applicable to Insurity's products, services, customers, vendors, and business operations. • Lead documented HIPAA risk analyses, risk treatment plans, control testing, remediation tracking, and periodic program evaluations. • Ensure appropriate administrative, physical, and technical safeguards for protected health information, including access control, authentication, audit controls, integrity, transmission security, encryption, contingency planning, and workforce security. • Partner with Legal, Privacy, Compliance, Product, and Customer Success on the HIPAA Privacy, Security, and Breach Notification Rules. • Establish requirements for Business Associate Agreements, customer obligations, subcontractors, cloud providers, and other third parties that create, receive, maintain, or transmit PHI. • Maintain audit-ready evidence and support customer diligence, independent assessments, regulatory inquiries, and OCR requests. • Lead the security component of PHI breach assessment, containment, investigation, notification coordination, and post-incident remediation. • Ensure HIPAA-specific workforce training, sanctions, and awareness requirements are incorporated into the broader security program. AI security, governance, and responsible adoption • Establish and lead Insurity's enterprise AI security and governance program. • Maintain an inventory of AI, machine learning, large language model, generative AI, and agentic systems used, developed, procured, or embedded in Insurity products and operations. • Define AI intake, risk classification, ownership, approval gates, prohibited uses, and human-oversight requirements. • Establish secure-use standards for generative AI, including requirements for confidential information, PHI, PII, customer data, source code, proprietary data, prompts, outputs, retention, and model training. • Define controls for AI-specific risks, including prompt injection, data leakage, insecure agents and tools, model abuse, data poisoning, supply-chain risk, unauthorized access, and unreliable or harmful outputs. • Partner with Legal, Privacy, Product, Engineering, Data, and Compliance to address transparency, intellectual property & data rights of emerging AI regulations. • Incorporate AI security and governance requirements into procurement, third-party risk management, secure development, cloud architecture, product reviews, and customer commitments. Risk management, compliance, and assurance • Develop a risk-based process for identifying, assessing, prioritizing, treating, and accepting information security and technology risks across Insurity's ecosystem. • Maintain alignment with applicable requirements and leading practices, including HIPAA, SOC 2, ISO/IEC 27001, GDPR & the NIST Cybersecurity Framework. • Orchestrate internal and external audits through planning, evidence collection, testing, findings management, remediation, and executive reporting. • Establish control ownership, evidence standards, issue-management processes, and sustainable remediation tracking. • Advise management on the costs, value, and risks of security and technology investments. • Support cyber-insurance requirements, underwriting reviews, claims preparation, and risk-improvement initiatives. • Monitor regulatory and contractual changes and translate them into practical requirements, policies, and implementation plans. • Report material risks, exceptions, incidents, and remediation plans to executive leadership and the Board. Security operations and incident response • Lead the enterprise security operations program, including monitoring, threat intelligence, vulnerability management, detection and response, penetration testing, and security investigations. • Manage security incident response coordinating both internally and externally from inception to resolution. • Maintain an incident response program that covers cyber incidents, privacy events, PHI incidents, ransomware, cloud compromise, insider threats, supply-chain events, and AI-related incidents. • Lead security incident response partnering with Insurity's COO and CLO while remaining sufficiently engaged in technical and operational details. • Establish escalation criteria, severity definitions, communications protocols, evidence-preservation practices, and post-incident review requirements. • Coordinate with Legal, Privacy, Compliance, Communications, customers, insurers, law enforcement, and regulators as appropriate. • Measure response effectiveness through exercises, lessons learned, time-to-detect, time-to-contain, time-to-recover, and remediation completion. • Lead regular cyber crisis tabletop exercises and simulations with executive leadership, key operational teams, customers, and external partners where appropriate. • Maintain crisis communications and breach-disclosure playbooks in partnership with Legal, Communications, Privacy, and executive leadership. • Ensure lessons from incidents and exercises are converted into funded improvements. Product, application, cloud, and infrastructure security • Embed security-by-design into product development, architecture, engineering, DevOps, and change-management processes. • Establish and oversee application security practices, including secure coding, threat modeling, SAST, DAST, software composition analysis, penetration testing, vulnerability disclosure, and release gates. • Lead software supply-chain security, including dependency governance, SBOMs, artifact integrity, code-signing expectations, CI/CD controls, and third-party component risk. • Oversee cloud-security architecture, identity and access management, encryption, secrets management, network segmentation, logging, monitoring, data-loss prevention, and secure configuration management. • Promote Zero Trust principles, least privilege, strong authentication, secure-by-default configurations, and continuous control monitoring. • Review and approve security architecture for major products, platforms, infrastructure changes, AI systems, and customer-facing capabilities. Third-party risk, customer trust, and commercial enablement • Establish a risk-based third-party security and privacy program covering vendors, cloud providers, subprocessors, partners, supply-chain participants, and other external parties. • Ensure contracts, security requirements, audit rights, breach obligations, data-use restrictions, and Business Associate obligations are addressed with Legal and Procurement. • Establish and maintain data classification, data inventory, data-flow, retention, deletion, residency, and access-governance practices. • Ensure security requirements are addressed across the lifecycle of customer, employee, regulated, confidential, and proprietary information. Leadership, organization, and culture • Build and lead a cost-efficient, high-performing security organization with appropriate direct and dotted-line relationships across Engineering, Product, IT, Cloud Operations, Privacy, Compliance, and other functions. • Hire, develop, coach, and retain security talent while establishing clear operating rhythms and accountability. • Create and manage security awareness and role-based training for employees, contractors, approved system users, developers, administrators, and executives. • Promote a culture in which security is viewed as an enabler of customer trust, product quality, resilience, and business growth. • Manage the security budget, partner strategy, managed service providers, and external security resources. • Define and report meaningful security metrics, risk indicators, maturity measures, control health, remediation progress, incident trends, audit results, customer commitments, and AI-governance metrics. Who We're Looking For • A strategic leader and builder who can establish vision, create alignment, and execute through influence. • A credible executive communicator who can brief the Board, lead a crisis, engage customers, and explain complex issues in simple terms. • A pragmatic security leader who balances risk reduction, business enablement, customer commitments, speed, and cost. • A collaborative partner to Engineering, Product, IT, Legal, Privacy, Compliance, Finance, Sales, Customer Success, and executive leadership. • A calm, decisive leader who can operate effectively in high-pressure, high-stakes situations. • A leader who is comfortable working hands-on when necessary while building a scalable team and operating model. Required qualifications and experience • Bachelor's degree in information security, computer science, information technology, business, or a related field; equivalent experience may be considered. • 8-10 years of progressive experience in information security, cybersecurity, technology risk, or related disciplines within a SaaS, cloud, technology, insurance, healthcare, or other regulated environment. • At least 5 years of executive or senior leadership experience in a CISO, Deputy CISO, Head of Security, or comparable role. • Demonstrated experience building and operating an enterprise security program across a distributed or remote organization. • Experience with HIPAA, ePHI, Business Associate requirements, healthcare data protection, or comparable regulated-data obligations. • Demonstrated experience leading security risk assessments, audits, remediation programs, and regulatory or customer assurance activities. • Experience leading material incidents, crisis response, business continuity, disaster recovery, and executive communications. • Experience establishing or operating an AI security, AI governance, responsible AI, model-risk, or secure-generative-AI program. • Strong understanding of cloud, SaaS operating models, identity, encryption, application security, vulnerability management, incident response, and third-party risk. • Exceptional written, verbal, presentation, negotiation, and stakeholder-influencing skills. • Demonstrated ability to manage budgets, partners, vendors, priorities, and complex cross-functional programs.