Chief Information Security Officer

Matter Health•Memphis, TN

About The Position

Matter Health is seeking an experienced Chief Information Security Officer (CISO) to lead and continuously strengthen its enterprise information security program. Reporting to the Chief Technology Officer, the CISO will develop and execute the organization’s information security strategy, establish policies and governance frameworks, oversee cybersecurity operations, and ensure compliance with applicable healthcare security requirements. The role works closely with Technology, Clinical Operations, Compliance, Legal, Engineering, and executive leadership to protect sensitive health information while supporting organizational growth. This is a high-visibility, hands-on executive leadership opportunity in a growing healthcare organization with a distributed, field-based care delivery model. The position will initially oversee a cybersecurity analyst and work alongside an external contractor supporting HITRUST certification efforts. The CISO will lead security resources and partners, provide strategic recommendations to leadership, and may occasionally present to the Board of Directors. Occasional travel of up to approximately 15% is expected. Matter Health delivers primary and preventive healthcare to older adults living in affordable housing communities. The organization describes its mission as improving healthcare access by meeting patients where they are and building trusted relationships in the communities it serves.

Requirements

Bachelor’s degree in Information Security, Computer Science, Information Systems, or a related field; equivalent experience will be considered.
At least 10 years of progressive information technology and cybersecurity experience, including significant experience in healthcare environments handling protected health information.
At least 5 years in a CISO, Head of Security, or comparable senior cybersecurity leadership role.
Demonstrated experience building, implementing, and leading enterprise information security programs.
Strong knowledge of HIPAA, HITECH, and applicable healthcare security regulations.
Experience overseeing cybersecurity operations, incident response, security monitoring, and enterprise risk management.
Hands-on experience with cloud security, identity and access management, endpoint security, and security governance.
Experience with SIEM platforms and oversight of internal or outsourced security operations centers.
Proven experience leading security incident investigations, containment, remediation, and recovery activities.
Demonstrated ability to develop security policies, establish governance frameworks, and manage third-party security risks.
Experience managing, mentoring, and developing cybersecurity professionals.
Strong communication skills, including the ability to present security strategy and risk assessments to executive leadership.
Ability to work collaboratively across Technology, Compliance, Legal, and Clinical Operations.
Willingness and ability to travel occasionally, up to approximately 15%.

Nice To Haves

Master’s degree in Information Security, Computer Science, Information Systems, or a related field.
Experience working in a startup, high-growth, or rapidly evolving healthcare organization.
Experience leading or supporting HITRUST CSF certification, readiness assessments, and ongoing compliance.
Experience securing Medicare, Medicaid, or Medicare Advantage healthcare environments.
Familiarity with CMS security requirements, payer security assessments, and healthcare regulatory expectations.
Experience securing integrations with electronic health record and patient engagement platforms, including athenahealth and Salesforce.
Professional security certifications such as CISSP, CISM, CRISC, HCISPP, or equivalent.
Experience communicating cybersecurity strategy, organizational risk, and security program performance to a Board of Directors or executive committee.

Responsibilities

Develop, implement, and continuously evolve the enterprise information security strategy in alignment with organizational goals, clinical operations, and regulatory requirements.
Establish and maintain security policies, standards, and procedures for data protection, access controls, acceptable use, and third-party risk management.
Build and mature security governance frameworks, including NIST CSF and HITRUST CSF.
Lead security budget planning, vendor selection, and technology investments in line with organizational priorities.
Manage and develop internal cybersecurity resources and collaborate with external security partners and consultants.
Provide security updates, risk assessments, and strategic recommendations to executive leadership, including occasional Board presentations.
Oversee threat detection, intrusion prevention, security monitoring, SIEM, and SOC operations.
Lead cybersecurity incident response, including investigation, containment, remediation, and recovery.
Develop and maintain incident response plans, coordinate tabletop exercises, and oversee incident preparedness.
Direct vulnerability management, penetration testing, and remediation across infrastructure, applications, and third-party integrations.
Oversee identity and access management, including privileged access management, role-based controls, and least-privilege principles.
Partner with Technology on secure cloud infrastructure, encryption, and data protection practices.
Oversee endpoint and mobile device security for clinical and field-based employees working in patients’ homes.
Partner with Technology and Clinical Operations on business continuity and disaster recovery planning.
Ensure compliance with the HIPAA Security Rule, HITECH, and applicable federal and state healthcare security requirements.
Partner with Compliance on patient privacy, regulatory reporting, breach notification obligations, and related requirements.
Support HITRUST certification, including security control implementation, readiness, remediation, and ongoing compliance.
Maintain security readiness for regulatory audits, payer security assessments, and third-party evaluations.
Oversee vendor and third-party security risk management, including reviews of business associates and partners handling protected health information.
Serve as a primary security contact for payer questionnaires, security attestations, audits, and due diligence requests.
Maintain working knowledge of Medicare, Medicaid, Medicare Advantage, CMS guidance, and payer-specific security expectations.
Partner with Technology, Engineering, Compliance, Legal, and Clinical Operations to integrate security into business processes and technology initiatives.
Develop and oversee organization-wide security awareness and training programs.
Promote security accountability, risk awareness, and continuous improvement.
Communicate cybersecurity risks and recommendations clearly to technical and nontechnical stakeholders.
Stay informed about emerging healthcare cybersecurity threats, regulatory changes, and industry best practices.
Travel occasionally, up to approximately 15%.

Benefits

Medical, dental, and vision insurance.
Employer-funded HSA options.
Employer-paid life and disability insurance.
Voluntary illness, accident, and hospitalization coverage.
Access to Matter Health’s in-person and virtual care services.
Competitive compensation package.
401(k) with company match, starting at day 60.
Financial wellness resources and support.
Up to 4 weeks of PTO.
10 paid company holidays.
2 volunteer days each year.
Opportunities for continued professional development and leadership growth.
Opportunity to build and lead a critical security function within a growing healthcare organization.
Collaboration with executive leadership and cross-functional teams.
Opportunity to help shape the long-term security strategy of an innovative, community-based healthcare organization.