Chief Information Security Officer

Qualified Health PBC

9d•$260,000 - $330,000•Hybrid

About The Position

As Qualified Health scales its AI platform across health systems and pharmaceutical sponsors, the Chief Information Security Officer will own the enterprise security strategy, risk posture, and security and privacy program. The role partners with executive leadership, Engineering, Product, Legal, and Commercial to embed security and data privacy into products, infrastructure, AI workflows, and business operations, and to lead security governance, healthcare compliance, incident response, and enterprise customer trust. This executive leadership role combines strategic ownership with technical depth. The CISO translates security risks into business decisions, works with engineering teams on technical challenges, and develops a rigorous security program that supports business needs and continued growth. The role also provides strategic and technical leadership for secure AI infrastructure and oversees DevOps and cloud infrastructure during the company's growth phase.

Requirements

12+ years of experience in information security or cybersecurity, including significant leadership experience at enterprise or high-growth technology companies.
Experience operating at CISO, VP of Security, or equivalent senior leadership level, with accountability for enterprise security strategy, risk management, and executive engagement.
Track record of building and scaling security programs, including foundational controls, governance, technical capabilities, and teams.
Deep technical understanding of cloud security, application security, identity and access management, vulnerability management, and incident response.
Experience owning or leading HIPAA and SOC 2 program success, including control implementation, audit readiness, and remediation.
Experience protecting sensitive or regulated data and translating compliance requirements into effective technical controls.
Experience leading enterprise customer security reviews and communicating security posture and risk to senior stakeholders.
Ability to influence executive leadership and cross-functional teams while balancing risk management with business priorities.

Nice To Haves

Experience at a high-growth healthcare technology, healthcare AI, life sciences technology, or enterprise SaaS company.
Experience securing AI-enabled applications, LLM-based systems, AI agents, or platforms handling sensitive healthcare data.
Experience with HITRUST, NIST Cybersecurity Framework, or NIST AI Risk Management Framework.
Experience presenting security posture, material risks, and investment recommendations to a board or board-level committee.
Hands-on experience leading or working closely with DevOps, SRE, or platform engineering teams.
Relevant certifications such as CISSP, CISM, or CCSP.

Responsibilities

Own the enterprise security strategy, risk posture, and roadmap, aligning priorities and investments with business objectives and the threat landscape.
Advise executive leadership on material risks, risk acceptance, security investments, and the implications of new products and customer engagements.
Establish security governance, policies, metrics, and organizational accountability.
Build and scale the security organization, selecting the mix of internal expertise, external partners, and capabilities needed as the company grows.
Set technical security direction across application security, cloud infrastructure, identity and access management, vulnerability management, and secure software development.
Partner with Engineering and Product to incorporate security into architecture, development, testing, deployment, and production operations.
Establish safeguards for AI-enabled products and workflows, including protection of PHI across LLM integrations, AI agents, data pipelines, and connected systems.
Work with engineering leaders to resolve high-impact technical risks while balancing security rigor with product velocity.
Provide strategic and technical leadership for designing and implementing secure AI infrastructure aligned with security objectives and compliance requirements.
Oversee DevOps and cloud infrastructure to ensure reliable, scalable, and secure platform operations.
Own the security program supporting HITRUST, SOC 2, and applicable customer and regulatory requirements, including control design, audit readiness, and ongoing effectiveness.
Partner with Legal, Privacy, Engineering, and business leaders to translate contractual and regulatory obligations into practical controls.
Serve as the senior security counterpart to health system and pharmaceutical customers, leading security diligence, technical assessments, and escalations.
Partner with Commercial and Customer Success to resolve security-related deal blockers and build customer confidence in the company's security posture.
Evaluate third-party and vendor risks and determine when additional frameworks or certifications are warranted.
Own the security incident response program, including detection, escalation, investigation, containment, recovery, and post-incident remediation.
Establish and test incident response, business continuity, and disaster recovery plans, coordinating with executive leadership, Legal, customers, and external specialists as needed.
Support the Privacy Team in meeting HIPAA and state privacy law reporting obligations through risk assessments, incident response, and audit readiness processes.
Build the operating model, tools, processes, and external partnerships needed to maintain effective security operations as the company scales.
Drive security awareness and clear security ownership across Engineering, IT, and other business functions.