Chief Information Security Officer

About the Role

Matter Health is seeking an experienced Chief Information Security Officer (CISO) to lead and continuously strengthen our enterprise information security program.

Our value-based care model depends on the trust of our patients, providers, and payer partners. Protecting sensitive health information across our distributed, field-based care delivery model is essential to maintaining that trust.

Reporting to the Chief Technology Officer, the CISO will be responsible for developing and executing Matter Health's information security strategy, establishing security policies and governance frameworks, overseeing cybersecurity operations, and ensuring compliance with applicable healthcare security regulations.

This is a high-visibility, hands-on executive leadership opportunity for someone who enjoys building and scaling security programs within a growing healthcare organization. The CISO will work closely with Technology, Clinical Operations, Compliance, and executive leadership to strengthen organizational security while supporting continued growth.

The position will initially oversee a cybersecurity analyst and work alongside an external contractor supporting Matter Health's HITRUST certification efforts.

The ideal candidate brings deep healthcare cybersecurity expertise, strong executive leadership capabilities, and the ability to balance enterprise-level security standards with the flexibility and adaptability required in a growth-stage environment.

Key Responsibilities

Information Security Strategy & Leadership

• Develop, implement, and continuously evolve Matter Health's enterprise information security strategy, ensuring alignment with organizational goals, clinical operations, and regulatory requirements.
• Establish and maintain security policies, standards, and procedures covering data protection, access controls, acceptable use, and third-party risk management.
• Build and mature security governance frameworks, including NIST CSF and HITRUST CSF, appropriate for an organization handling protected health information (PHI).
• Lead security budget planning, vendor selection, and technology investments while balancing security needs with organizational priorities.
• Manage and develop internal cybersecurity resources while collaborating with external security partners and consultants.
• Provide regular security updates, risk assessments, and strategic recommendations to executive leadership, including occasional presentations to the Board of Directors.

Cybersecurity Operations & Risk Management

• Oversee threat detection, intrusion prevention, security monitoring, and Security Information and Event Management (SIEM) and Security Operations Center (SOC) operations.
• Lead cybersecurity incident response, including incident investigation, containment, remediation, and recovery.
• Develop and maintain incident response plans, coordinate tabletop exercises, and oversee organizational preparedness for potential security incidents.
• Direct vulnerability management, penetration testing, and remediation programs across infrastructure, applications, and third-party integrations.
• Oversee identity and access management (IAM), including privileged access management, role-based controls, and least-privilege principles.
• Partner with Technology to maintain secure cloud infrastructure, encryption, and data protection practices.
• Oversee endpoint and mobile device security for clinical and field-based employees working in patients' homes.
• Partner with Technology and Clinical Operations on business continuity and disaster recovery planning to support operational resilience.

Healthcare Security, Compliance & Governance

• Ensure compliance with the HIPAA Security Rule, HITECH, and applicable federal and state healthcare security requirements.
• Partner with Compliance on patient privacy, regulatory reporting, breach notification obligations, and related requirements.
• Support organizational HITRUST certification initiatives, including security control implementation, readiness activities, remediation, and ongoing compliance.
• Maintain security readiness for regulatory audits, payer security assessments, and third-party evaluations.
• Oversee vendor and third-party security risk management, including security reviews of business associates and partners handling protected health information.
• Serve as a primary security contact for payer questionnaires, security attestations, audits, and due diligence requests.
• Maintain working knowledge of Medicare, Medicaid, Medicare Advantage, CMS guidance, and payer-specific security expectations.

Collaboration & Security Culture

• Partner with Technology, Engineering, Compliance, Legal, and Clinical Operations to integrate security into business processes and technology initiatives.
• Develop and oversee organization-wide security awareness and training programs.
• Promote a culture of security accountability, risk awareness, and continuous improvement.
• Communicate complex cybersecurity risks and recommendations clearly to technical and nontechnical stakeholders.
• Stay informed of emerging healthcare cybersecurity threats, regulatory changes, and industry best practices.

Qualifications

• Bachelor's degree in Information Security, Computer Science, Information Systems, or a related field; equivalent experience will be considered.
• 10+ years of progressive information technology and cybersecurity experience, including significant experience in healthcare environments handling protected health information.
• At least 5 years of experience in a CISO, Head of Security, or comparable senior cybersecurity leadership role.
• Demonstrated experience building, implementing, and leading enterprise information security programs.
• Strong knowledge of HIPAA, HITECH, and applicable healthcare security regulations.
• Experience overseeing cybersecurity operations, incident response, security monitoring, and enterprise risk management.
• Hands-on experience with cloud security, identity and access management, endpoint security, and security governance.
• Experience with SIEM platforms and oversight of internal or outsourced security operations centers.
• Proven experience leading security incident investigations, containment, remediation, and recovery activities.
• Demonstrated ability to develop security policies, establish governance frameworks, and manage third-party security risks.
• Experience managing, mentoring, and developing cybersecurity professionals.
• Strong communication skills with the ability to present security strategy and risk assessments to executive leadership.
• Ability to work collaboratively across Technology, Compliance, Legal, and Clinical Operations.
• Willingness and ability to travel occasionally, up to approximately 15%.

Strongly Preferred

• Master's degree in Information Security, Computer Science, Information Systems, or a related field.
• Experience working in a startup, high-growth, or rapidly evolving healthcare organization.
• Experience leading or supporting HITRUST CSF certification, readiness assessments, and ongoing compliance.
• Experience securing Medicare, Medicaid, or Medicare Advantage healthcare environments.
• Familiarity with CMS security requirements, payer security assessments, and healthcare regulatory expectations.
• Experience securing integrations with electronic health record and patient engagement platforms, including athenahealth and Salesforce.
• Professional security certifications such as CISSP, CISM, CRISC, HCISPP, or equivalent.
• Experience communicating cybersecurity strategy, organizational risk, and security program performance to a Board of Directors or executive committee.

Why Matter Health?

We believe that where someone lives should never determine the care they receive. Every team member at Matter Health is essential in improving healthcare access for older adults who have historically been underserved by traditional systems.

As our Chief Information Security Officer, you'll have the opportunity to shape and strengthen a critical organizational function while helping protect the patients, providers, employees, and communities we serve.

You'll work alongside a collaborative leadership team, help establish a strong security foundation for continued growth, and play a meaningful role in advancing a healthcare model focused on accessibility, quality, and compassionate care.

This is not just our mission - it's our daily work.

We Lead with Love in Everything We Do.

Working at Matter Health

We're committed to supporting every team member, both at work and beyond. Full-time employee benefits begin the first of the month following your start date.
Health & Wellness

• Medical, dental, and vision insurance
• Employer-funded HSA options
• Employer-paid life and disability insurance
• Voluntary illness, accident, and hospitalization coverage
• Access to Matter Health's in-person and virtual care services

Financial Security

• Competitive Compensation Package
• 401(k) with company match, starting at day 60
• Financial wellness resources and support

Time Away

• Up to 4 weeks of PTO
• 10 paid company holidays
• 2 volunteer days each year to support causes meaningful to you

Professional Growth

• Opportunities for continued professional development and leadership growth
• The opportunity to build and lead a critical security function within a growing healthcare organization
• Collaboration with executive leadership and cross-functional teams
• The ability to help shape the long-term security strategy of an innovative, community-based healthcare organization

Eligibility for benefits is based on full-time employment status. More details will be shared during the interview process.