Senior Manager, Information Security

Vatica Health

7d•$160,000 - $170,000

About The Position

The Senior Manager, Information Security leads day-to-day execution of the information security program across Vatica Health + Cozeva, protecting healthcare data, systems, and platforms. The role translates security strategy into prioritized work, effective controls, and measurable improvements in risk reduction and incident readiness. The Senior Manager leads and develops security professionals and partners with Engineering, Infrastructure, DevOps, Compliance, and business leaders to embed security into technology delivery and operations. The position combines technical judgment with disciplined execution, clear communication of business risk, and accountability for resolving security gaps. The role oversees security program delivery, security engineering and vulnerability management, cloud infrastructure and data protection, security operations and incident response, governance and assurance, and security risks involving AI and emerging technologies. It supports applicable HIPAA obligations, HITRUST requirements, SOC 2 examinations, internal reviews, disaster recovery, and business continuity testing.

Requirements

Bachelor’s degree in Information Security, Computer Science, Information Technology, or a related field, or equivalent practical experience.
10+ years of progressive experience in cybersecurity, information security, or security engineering, including 2+ years leading security teams or managing security programs.
Demonstrated success translating security priorities into implemented controls, resolved findings, and measurable operational improvements in a regulated environment.
Hands-on experience with cloud and enterprise security, including Azure and AWS, identity and access management, endpoint protection, network security, encryption, and key management.
Experience with security monitoring and SIEM platforms, endpoint detection and response, web application firewalls, data loss prevention, and vulnerability management tools.
Experience leading incident response and coordinating remediation across technical teams.
Working knowledge of secure software development, DevSecOps, and Zero Trust principles.
Ability to assess business risk, set priorities, communicate recommendations to technical and business audiences, and drive follow-through across teams.

Nice To Haves

Experience protecting healthcare environments and protected health information (PHI), with knowledge of HIPAA, HITRUST, SOC 2, and the NIST Cybersecurity Framework.
Experience securing cloud-native platforms, AI-enabled applications, and third-party AI integrations.
Relevant security certification such as CISSP, CISM, CCSP, GIAC, or a cloud security certification.

Responsibilities

Translate the security roadmap into priorities, delivery plans, and team goals; assign ownership, monitor progress, and escalate resource constraints and unresolved risks.
Coach security team members, manage performance, and oversee security vendors, projects, and approved budgets.
Lead security control implementation across Azure, AWS, and on-premises environments.
Partner with technical owners on architecture reviews, secure design, threat modeling, and security checks in software delivery pipelines.
Prioritize vulnerabilities by exposure and business impact, track remediation with accountable owners, and verify closure.
Oversee cloud configuration monitoring, identity and privileged access controls, endpoint and network protection, encryption, and data loss prevention.
Partner with Infrastructure and Engineering to address control gaps and advance Zero Trust practices.
Oversee monitoring, threat detection, investigation, and response; lead technical incident coordination, containment, and recovery with system owners.
Escalate incidents promptly to leadership and Compliance; maintain response plans, conduct exercises and lessons-learned reviews, and track corrective actions.
Support disaster recovery and business continuity testing.
Maintain security policies, standards, risk assessments, and control evidence in partnership with Compliance.
Support applicable HIPAA obligations, HITRUST requirements, SOC 2 examinations, and internal reviews; track findings through remediation and report control effectiveness, risk trends, and decisions needed from leadership.
Assess security risks in AI tools, external services, and third-party integrations; implement safeguards against sensitive data exposure and unauthorized access.
Partner with Engineering and Compliance on approved AI use, access controls, and monitoring, and evaluate emerging threats and security technologies.