Head of Information Security

Help at Home•Anywhere US/Remote, UNAVAILABLE

About The Position

The Head of Information Security is responsible for leading and advancing Help at Home’s enterprise-wide information security program. This hands-on leadership role oversees security operations, cybersecurity strategy execution, risk management, and regulatory compliance initiatives to protect company systems, data, and business operations. The Head of Information Security partners closely with Information Technology, Finance, Legal, Compliance, Privacy, Procurement, Internal Audit, and senior business leaders to strengthen security controls, enhance organizational resilience, and foster a culture of security awareness. This position serves as a trusted advisor to executive leadership, providing strategic guidance on emerging threats, risk mitigation, and the continued maturity of the organization’s cybersecurity program.

Requirements

Strong business acumen and the ability to frame information security as a business issue.
Hands-on leadership style with strong technical depth.
Ability to lead a team through rapid change and competing priorities.
Ability to influence others where there is no direct authority.
Ability to propose creative, practical solutions to security-specific business problems.
Proven record of meeting operational objectives and earning the respect of the organization through results.
Ability to translate cyber risk and technical concepts into clear recommendations for business and technology leaders.
Strong communication skills with technical and non-technical audiences.
Demonstrated ownership, accountability, teamwork, and cross-functional collaboration.
All employees must follow Help at Home cybersecurity and privacy policies, protect sensitive data, complete required training, and report suspected incidents. They must also follow acceptable use and access requirements and use only authorized systems.
Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent relevant experience required.
12+ years of experience in information security, including 3+ years leading security teams, programs, or cross-functional security initiatives required.
Hands-on experience running security operations, including incident response and vulnerability management, and managing MSSP or vendor partners required.
Experience remediating SOX / ITGC control deficiencies or material weaknesses required.
Experience developing and running BCP/DR programs with non-technical business stakeholders required.
Experience maintaining and updating security policy, including emerging areas such as AI usage required.
Working knowledge of security and compliance frameworks such as NIST, ISO 27001, SOC 2, or CIS Controls required.

Nice To Haves

Security certification such as CISSP, CISM, CISA, CRISC, or CCSP preferred.
Healthcare or other highly regulated industry experience preferred.
Experience in a public-company or SOX-regulated environment preferred.
Experience with AI governance frameworks, such as NIST AI RMF, preferred.
Experience with cloud security (AWS, Azure, GCP, or hybrid) and enterprise security technologies such as SIEM, EDR/XDR, IAM, and DLP preferred.
Experience supporting M&A security integration preferred.
Experience leading tabletop exercises, penetration testing, or red team/blue team activities preferred.

Responsibilities

Own execution of the enterprise security strategy and roadmap, translating strategic direction into operating plans, priorities, and measurable outcomes.
Lead and operate the day-to-day security program, including governance, risk management, security operations, and program metrics.
Establish and maintain meaningful security metrics, key risk indicators, and reporting to support decision-making and transparency.
Monitor emerging threats, legislation, and industry developments; assess risk exposure and drive timely mitigation.
Own day-to-day security operations, including monitoring and detection, vulnerability management, security engineering, and incident response.
Lead, hire, and develop the security team, including resource planning, coaching, and prioritization of work against business-critical objectives.
Manage relationships with MSSPs, tooling partners, and other third-party security providers and ensure vendor performance meets expectations.
Oversee identity and access management, cloud security, application security, and data protection programs.
Ensure security participation in the software development lifecycle and embed security requirements into products, platforms, and vendor relationships.
Maintain and update security policies, standards, and procedures, including policies governing the responsible use of AI.
Participate in enterprise AI governance, partnering with IT, Legal, Compliance, and business leaders to assess AI use cases, define acceptable use, and manage data, model, and third-party AI risk.
Partner with Finance, IT, and Internal Audit to remediate material weaknesses and strengthen IT general controls, including access management and change management.
Own the security-related control environment and evidence and support internal and external audit, certification, and customer assurance activities.
Ensure alignment with applicable regulatory requirements, including HIPAA and SOX, and recognized frameworks such as NIST CSF, ISO 27001, SOC 2, or CIS Controls.
Lead business continuity planning (BCP) and disaster recovery alignment, working directly with business stakeholders to define critical processes, recovery objectives, and response plans.
Lead incident response and crisis management readiness, including tabletop exercises and post-incident improvement.
Support enterprise cyber risk management, including risk identification, assessment, mitigation, and monitoring.
Oversee third-party and vendor security risk assessments.
Support security due diligence for mergers, acquisitions, and integrations.
Act as a trusted security resource for business and technology leaders, translating technical risk into clear, practical recommendations.
Prepare and help present security materials for executive leadership and, as needed, the Board.
Build working relationships with regulators, industry groups, and external security partners as needed.
Lead cybersecurity awareness, education, and culture initiatives across the enterprise.