Job Description SummaryAt Castlight, we are looking for a Senior Manager, IT Security who operates as an impactful player-coach, bridging deep technical security execution with strategic, client-facing leadership. Reporting directly to the Head of Technology, you will lead a dedicated security team while actively contributing to GCP cloud and application security, supporting our internal audit team across SOC 2, HITRUST, and NIST, and championing our security posture to major employers and health plans. Whether you are guiding AppSec best practices, defending our architecture on a CISO call, or serving as the steady client bridge during an incident, you will be the guardian of the trust and systems that power healthcare journeys for millions of users. If you are a high-agency leader who thrives at the intersection of hands-on security engineering and executive commercial engagement, we want to talk to you.
What You'll Do:Reporting directly to the Head of Technology, you will lead Castlight's dedicated security organization while driving customer-facing security trust and hands-on technical execution. Operating as a true player-coach, you will balance team leadership and strategic governance, direct technical and architectural execution, and client enablement and support.
In this role, you will:- Lead & Elevate the Security Team: Lead, coach, and support a dedicated team across SecOps, AppSec, CloudSec, and GRC-setting clear technical expectations, removing operational roadblocks, and fostering a culture of high agency and accountability.
- Drive Security Operations & Automation: Oversee SecOps capabilities, including security automation (SOAR), infrastructure hardening, vulnerability management, and patch management coordination to strengthen the organization's overall security posture.
- Champion Client Support & Sales Enablement: Partner with commercial, legal, and sales leadership to represent Castlight's security posture to prospective and current customers. Address security provisions in contracts, guide technical responses for complex RFPs, and lead security defense calls with client CISOs and risk teams.
- Lead Customer Incident Communications: Serve as the primary, trusted technical bridge to customers when security issues or critical vulnerabilities arise-translating technical remediation into executive-ready communication alongside our CISO and Engineering leadership.
- Execute Hands-on in AppSec & Cloud Security: Dive into technical reviews, guide AppSec standards across GitHub Actions and deployment pipelines, and shape secure cloud infrastructure patterns on Google Cloud Platform (GCP).
- Support Auditability & Maintain Framework Standards: Partner closely with our internal audit team by embedding robust controls across engineering workflows, ensuring our technical architecture and operations continuously align with SOC 2, HITRUST, and NIST standards.
- Drive Cohesive Incident Escalation & Response: Oversee vulnerability management and incident response escalations, coordinating closely with enterprise cyber operations to ensure swift containment, remediation, and recovery from emerging threats.
- Establish Security Operations Metrics: Define and track key SecOps KPIs, including vulnerability remediation timelines, patch compliance, and security configuration drift, to measure operational effectiveness and drive continuous improvement.
Skills & Qualifications:- Leadership Experience: 7+ years of progressive information security experience, including demonstrated success leading, coaching, and mentoring technical security engineers in a player-coach capacity.
- Client-Facing Acumen: Proven capability to interact directly with enterprise customer security leaders, procurement specialists, and health plan CISOs. Experience reviewing security contract terms, supporting enterprise RFPs, and articulating complex security postures to external stakeholders.
- Technical AppSec & Cloud Depth: Hands-on experience with Application Security (DAST, secure SDLC, CI/CD pipeline controls) and Cloud Security architecture, with an emphasis on Cloud Platform (We run GCP - but any cloud platform is sufficient) and containerized/microservice ecosystems.
- Security Framework Familiarity: Working knowledge of SOC 2, HITRUST, and NIST frameworks, with a track record of implementing technical controls and supporting auditability.
- Crisis Management & Communication: Exceptional communication and presentation skills, with the ability to maintain composure during security incidents and clearly explain root cause, blast radius, and remediation roadmaps to client leadership.
- Cross-Functional Collaboration: Demonstrated ability to partner effectively with Engineering, Product, Legal, and executive leadership, balancing defense-in-depth with business momentum.
Compensation Range:$144,368.00
to
$216,552.00
The anticipated base salary range represents the Company's good-faith estimate of the compensation it reasonably expects to pay for this position at the time of posting. Actual compensation will be determined based on factors including experience, skills, qualifications, geographic location, internal equity, and business needs.
