Director, Information Security

4 hours, 27 minutes ago
Full-time
Executive
Cybersecurity
Carrot Fertility

Carrot Fertility

Carrot Fertility provides comprehensive global fertility benefits for employers, facilitating access to a wide range of fertility care services, including egg and sperm freezing, IVF, gestational surrogacy, and adoption, while offering personalized sup...

Insurance
251-1K
Founded 2016
$114M raised

Description

  • Lead Carrot’s security strategy, roadmap, maturity model, investment priorities, and executive reporting.
  • Own corporate and product security programs, including GRC, incident response, awareness, vendor risk, application, cloud, infrastructure, and secure SDLC.
  • Partner with Engineering and Internal Platform teams to embed security into system design, delivery, and operations.
  • Conduct risk assessments and translate findings into prioritized technical safeguards and remediation plans.
  • Manage SOC 2 Type II, HITRUST, PCI DSS, and HIPAA compliance, while preparing for frameworks such as ISO 27001.
  • Direct incident response readiness, playbooks, tabletop exercises, executive communications, and post-incident improvements.
  • Represent Carrot in customer security reviews, questionnaires, and strategic sales conversations.
  • Partner with Legal and Privacy on HIPAA, GDPR, and CCPA/CPRA requirements.
  • Build, coach, and scale the security team, including defining roles and making key hires.
  • Manage the security budget, tools, vendors, and security guidance for remote and office-based employees.

Requirements

  • Bachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent experience.
  • 10+ years of technology experience, including 5+ years in information security and 3+ years leading security teams.
  • CISSP, CISM, or comparable security certification.
  • Experience leading security at a late-stage startup, scale-up, or public company.
  • Working knowledge of HIPAA, GDPR, and CCPA/CPRA.
  • Experience overseeing SOC 2 Type II, HITRUST, PCI DSS, and ISO 27001 audits or frameworks.
  • Strong knowledge of application, network, and cloud security, including AWS, Azure, NIST CSF, and OWASP.
  • Experience with incident response, risk and vulnerability management, penetration testing, and security awareness programs.
  • Executive communication skills and confidence engaging customers, executives, and sales teams.
  • Experience managing security budgets, resources, tools, and vendors.
  • Preferred: experience with IPOs, acquisitions, healthcare or digital health, remote-first global organizations, Drata, or security engineering practices.

Benefits

  • Base salary range of $188,000–$245,000.
  • Competitive compensation, equity, and comprehensive benefits.
  • Health and wellness benefits, retirement savings plans, and short- and long-term incentives.
  • Flexible time off and a culture that encourages employees to recharge.
  • Comprehensive parental leave and family-forming assistance.
  • Mission-driven, collaborative, inclusive, and values-based work environment.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Director, Security

Lightspeed DMS 51-250 Automotive

Lightspeed is seeking a Director of Security to lead cybersecurity strategy and protect its cloud-based dealership management platform, dealer data, internal systems, and personnel.

Cybersecurity Penetration Testing
4 hours, 57 minutes ago

Senior Threat Intelligence Engineer

Coalition 251-1K Insurance

Coalition is hiring a Threat Intelligence professional to identify emerging vulnerabilities, lead zero-day response, and develop detections and threat intelligence that help protect policyholders from digital risk.

Penetration Testing Python SQL
1 day, 4 hours ago

Senior Threat Intelligence Engineer

Coalition 251-1K Insurance

Coalition is hiring a Threat Intelligence professional to identify emerging vulnerabilities, develop threat detections, and help prevent cyber losses for policyholders through its Active Insurance platform.

Cybersecurity Penetration Testing Python SQL
1 day, 4 hours ago

Staff Security Engineer, Security Enablement

DoorDash 10K-50K Air Freight & Logistics

DoorDash is hiring a Staff Security Engineer to architect and deliver global, multi-domain security services spanning physical security, cloud infrastructure, identity, networking, and operational systems.

AWS DevSecOps GCP JIRA Network Security Python REST API SQL
2 days, 4 hours ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers