Chief Information Security Officer (CISO)

Spring Health•New York, NY

14h•Hybrid

About The Position

Spring Health is hiring a Chief Information Security Officer to define and lead its enterprise-wide information security, technology risk, compliance, and IT strategy. Reporting to the Chief Technology Officer, the CISO will lead the Information Security, Compliance/GRC, and IT functions, including security operations, application and product security, cloud and infrastructure security, identity and access management, third-party risk, incident response, enterprise compliance, corporate IT, and business technology operations. The role includes managing and partnering with senior security and IT leaders, including the VP, Information Security, and advising executive leadership and the Board on cybersecurity risk, regulatory readiness, enterprise resilience, customer trust, and technology risk. The CISO will build an organization that enables business growth, product velocity, and operational scale while protecting company, customer, member, provider, and other sensitive healthcare data. Priorities include supporting the integration of Alma, enterprise customer growth, AI transformation, international expansion, and readiness for future public-company expectations. The role will establish practical security and AI governance, maintain compliance with applicable healthcare and privacy requirements, strengthen customer trust processes, and oversee corporate technology operations and employee technology experience. This is a hybrid role based in New York City or San Francisco, with an expectation to work in the office two to three days per week. Candidates must be based in the NYC or SF metro areas or able to relocate independently within 90 days of their start date. Frequent travel is required for leadership meetings and visits to office locations.

Requirements

15+ years of progressive experience in information security, cybersecurity, IT, technology risk, or related disciplines, including significant experience in executive security leadership roles.
Demonstrated experience leading multi-functional security organizations across security operations, application/product security, cloud security, GRC/compliance, identity and access management, incident response, and third-party risk.
Experience leading or closely partnering with IT, corporate technology, business applications, employee technology, endpoint management, SaaS governance, and access lifecycle functions.
Deep working knowledge of HIPAA and hands-on experience leading security and compliance programs in a covered entity or business associate environment.
Experience owning or overseeing HITRUST, SOC 2, ISO 27001, PCI DSS, GDPR, CCPA, and other relevant third-party security, privacy, and compliance programs.
Strong understanding of healthcare technology, sensitive data environments, enterprise customer expectations, and the security and compliance requirements of serving employers, health plans, providers, members, and partners.
Ability to communicate cybersecurity and technology risk to executive and Board-level audiences, translating technical issues into business, financial, customer, and regulatory impact.
Experience leading security and/or IT through M&A integration, divestitures, major business transformation, IPO or public-company readiness, or other high-complexity operating environments.
Experience building and scaling high-performing teams, including hiring, developing leaders, clarifying operating models, and driving accountability across functions.
Strong technical fluency across cloud security, application security, identity and access management, security architecture, threat management, vulnerability management, incident response, and modern SaaS architecture.
Practical experience developing AI security strategy, enterprise AI governance, data classification practices, and guardrails for safe AI adoption.
Experience as an executive security leader in customer-facing enterprise security reviews, audits, RFP/RFI responses, technical diligence, and customer escalations.
Experience partnering effectively with Legal, Privacy, Compliance, Engineering, Product, Sales, Customer Success, People, Finance, and executive leadership.
Strong business judgment and ability to balance security, compliance, customer trust, employee experience, product velocity, innovation, and operational efficiency.
Must be based in the NYC or SF metro area, or able to relocate independently within 90 days of the start date.

Nice To Haves

One or more recognized industry certifications relevant to the role, such as CISSP, CISM, CCISO, CRISC, CISA, or similar credentials.

Responsibilities

Develop and execute enterprise-wide information security, compliance, technology risk, and IT strategy aligned with company priorities, growth plans, and regulatory obligations.
Lead the Information Security, Compliance/GRC, and IT organizations, including security operations, application and product security, cloud and infrastructure security, enterprise compliance, corporate IT, identity and access management, and business technology operations.
Partner with the CTO and stakeholders across executive leadership, Legal, Privacy, Compliance, Product, Engineering, Sales, Customer Success, People, and Finance to enable the business while avoiding unnecessary friction.
Advise executive leadership and the Board on cybersecurity and technology risks, regulatory readiness, incident response, enterprise resilience, customer trust, and security investments.
Build and scale a high-performing security, compliance, and IT organization by developing leaders, clarifying ownership, improving operating rhythms, and establishing appropriate structure and capabilities.
Oversee security operations, including threat detection, vulnerability management, incident response, security monitoring, endpoint security, SIEM strategy, threat intelligence, and resilience exercises.
Embed application, product, and cloud security in the software development lifecycle through secure architecture, threat modeling, automated testing, vulnerability remediation, and security reviews.
Own enterprise compliance and information security risk management, including risk assessments, risk registers, risk treatment plans, control frameworks, policy governance, and executive reporting.
Ensure compliance outcomes across applicable frameworks and regulations, including HIPAA, HITRUST, SOC 2, ISO 27001, PCI DSS, GDPR, CCPA, and other healthcare, privacy, and security requirements.
Partner with Legal and Privacy on data protection, privacy, regulatory obligations, Business Associate Agreements, customer commitments, breach assessment and notification obligations, and evolving healthcare security requirements.
Lead security and IT strategy for the Alma integration, including systems, data flows, access controls, compliance obligations, enterprise risk, data protection, and long-term operating model decisions.
Define and govern the enterprise AI security strategy, including AI guardrails, approved tool usage, data classification, model and tool risk assessment, secure AI adoption, and protection of sensitive data.
Oversee corporate IT and business technology operations, including employee technology experience, endpoint management, access lifecycle, SaaS governance, corporate applications, IT service delivery, and operational excellence.
Serve as an executive sponsor in enterprise customer security reviews, audits, RFPs/RFIs, customer escalations, and technical diligence.
Develop scalable customer trust processes, security narratives, artifacts, and evidence practices that reduce friction for Sales and Customer Success while maintaining risk discipline.
Lead responses to significant security incidents, including technical response, executive and customer communications, Legal and Compliance partnership, regulatory considerations, post-incident review, and remediation.
Manage security, compliance, and IT budgets, vendor relationships, tooling strategy, cyber insurance engagement, external audit partnerships, and technology investments.
Establish security, compliance, and IT metrics that give executive leadership and the Board visibility into risk posture, program maturity, operational performance, and investment priorities.
Promote a company-wide culture of security, privacy, accountability, and responsible innovation.

Benefits

Health, dental, and vision benefits beginning on the first day.
One Medical accounts for employees and dependents.
HSA and FSA plans; Spring contributes up to $1,000 to HSAs depending on plan type.
Employer-sponsored 401(k) match of up to 2%.
Yearly allotment of no-cost visits to Spring Health therapists, coaches, and medication management providers for employees and dependents.
Paid time off policies including vacation, sick leave, and company holidays.
At six months of tenure, parental leave of 18 weeks for birthing parents and 16 weeks for non-birthing parents.
Access to Noom, a psychology-based weight management program.
Fertility care support through Carrot and up to $4,000 reimbursement for related fertility expenses.
Access to Wellhub for fitness, mindfulness, nutrition, and sleep options.
Access to BrightHorizons sponsored child care, backup care, and elder care.
Up to $1,000 per year in professional development reimbursement.
Up to $200 per year in donation matching.