Chief Information Security Officer (CISO)

Insurity

17h•$216,000 - $325,000

About The Position

Insurity is seeking a strategic, operational, and technically credible Chief Information Security Officer to lead its enterprise security, cybersecurity risk, privacy, and AI governance programs. The CISO will protect Insurity’s information assets, products, customer environments, and technology ecosystem while supporting business growth, cloud adoption, international expansion, and responsible AI use. The role translates cybersecurity, privacy, compliance, and technology risks into clear business decisions for executive leadership and the Board. The CISO will develop and oversee enterprise security strategy and governance; HIPAA and electronic protected health information safeguards; AI security and responsible-use controls; risk management, compliance, and assurance; security operations and incident response; product, application, cloud, and infrastructure security; and third-party risk and customer trust. The position also builds and leads a cost-efficient security organization, develops talent and security awareness, manages budgets and external partners, and reports meaningful security, risk, audit, incident, and AI-governance metrics. The successful candidate will combine executive presence and practical execution, setting strategy while engaging with customers, regulators, and the Board; directing major incidents; reviewing architecture; and building the processes, team, and culture needed for a growing SaaS company. The role may be remote, in-office, or hybrid depending on role and location.

Requirements

Bachelor’s degree in information security, computer science, information technology, business, or a related field; equivalent experience may be considered.
8–10 years of progressive experience in information security, cybersecurity, technology risk, or related disciplines in a SaaS, cloud, technology, insurance, healthcare, or other regulated environment.
At least 5 years of executive or senior leadership experience in a CISO, Deputy CISO, Head of Security, or comparable role.
Experience building and operating an enterprise security program across a distributed or remote organization.
Experience with HIPAA, ePHI, Business Associate requirements, healthcare data protection, or comparable regulated-data obligations.
Experience leading security risk assessments, audits, remediation programs, and regulatory or customer assurance activities.
Experience leading material incidents, crisis response, business continuity, disaster recovery, and executive communications.
Experience establishing or operating an AI security, AI governance, responsible AI, model-risk, or secure-generative-AI program.
Strong understanding of cloud and SaaS operating models, identity, encryption, application security, vulnerability management, incident response, and third-party risk.
Exceptional written, verbal, presentation, negotiation, and stakeholder-influencing skills.
Demonstrated ability to manage budgets, partners, vendors, priorities, and complex cross-functional programs.

Nice To Haves

CISSP, CISM, CISA, CRISC, CCSP, or equivalent certification.
Experience with SOC 2 Type II, ISO/IEC 27001, NIST CSF, NIST AI RMF, or comparable frameworks.
Experience with AI/ML security, LLM security, agent security, model risk management, AI impact assessments, or AI red teaming.
Experience supporting customer security reviews, RFPs, renewals, and executive-level trust discussions.
Experience in insurance technology, property and casualty insurance, healthcare technology, or another data-intensive regulated industry.
Experience with cyber-risk quantification, cyber insurance, secure software supply chains, DevSecOps, and cloud-native security.

Responsibilities

Develop, implement, and continuously improve enterprise information security strategy, policies, standards, and control frameworks.
Align security priorities with business strategy, product roadmaps, customer commitments, and organizational risk appetite; establish governance forums and Board reporting.
Define security accountability across Engineering, Product, Corporate IT, Cloud Operations, Legal, Privacy, and Compliance.
Own and mature the HIPAA compliance and ePHI protection program, including risk analyses, safeguards, training, audit evidence, customer diligence, and breach response.
Establish and lead enterprise AI security and governance, including AI system inventory, risk classification, approval processes, safe-use standards, oversight requirements, and controls for AI-specific risks.
Develop risk-based processes to identify, assess, prioritize, treat, and accept information security and technology risks.
Maintain alignment with applicable requirements and practices, including HIPAA, SOC 2, ISO/IEC 27001, GDPR, and the NIST Cybersecurity Framework.
Orchestrate internal and external audits, evidence collection, testing, findings management, remediation, and executive reporting.
Advise management on security and technology investment costs, value, and risks; support cyber-insurance requirements, underwriting, claims preparation, and risk improvements.
Lead enterprise security operations, including monitoring, threat intelligence, vulnerability management, detection and response, penetration testing, and investigations.
Manage incident response from inception to resolution; coordinate crisis communications, breach-disclosure playbooks, exercises, post-incident reviews, and funded improvements.
Embed security-by-design in product development, architecture, engineering, DevOps, and change management; oversee application and software supply-chain security.
Oversee cloud security architecture, identity and access management, encryption, secrets management, network segmentation, logging, monitoring, data-loss prevention, and secure configuration.
Review and approve security architecture for major products, platforms, infrastructure changes, AI systems, and customer-facing capabilities.
Establish a risk-based third-party security and privacy program and work with Legal and Procurement on contracts, security requirements, audit rights, breach obligations, data-use restrictions, and Business Associate obligations.
Establish and maintain data classification, inventory, flows, retention, deletion, residency, access governance, and lifecycle security practices.
Build and lead a high-performing security organization; hire, develop, coach, and retain talent and establish operating rhythms and accountability.
Create and manage security awareness and role-based training for employees, contractors, system users, developers, administrators, and executives.
Manage the security budget, partner strategy, managed service providers, and external security resources.
Define and report security metrics, risk indicators, maturity measures, control health, remediation progress, incident trends, audit results, customer commitments, and AI-governance measures.

Benefits

Open PTO policy.
Comprehensive health coverage, including medical, dental, and vision insurance.
Employer-matched retirement savings / 401(k) match.
Paid maternity leave.
Paid paternity leave.
Disability insurance.
Flexible remote, in-office, or hybrid work options depending on role and location.
Award-winning onboarding program.
Mentorship program.
Access to LinkedIn Learning and Kaplan.
Discounted tuition for employees and family through the University of Arizona Global Campus partnership.
Employee Referral Bonus program.