Vice President, Information Security

Stellar Health

2d•$290,000 - $330,000

About The Position

Stellar Health is seeking a Vice President, Information Security to lead and evolve the company’s security program. The role owns information security strategy, operations, governance, and budget, reports to the Chief Compliance Officer (CCO), and works closely with the Chief Technology Officer and leaders across Engineering, Product, Operations, Legal, and People. The VP will lead a small team and may grow it as business needs evolve. The security function is part of a relatively mature Compliance team, and a threat-based risk framework is already in place. The role will scale the function and redesign its operating model as needed, advance security governance with the CCO, build a multi-year roadmap tied to company growth, address security implications of expanding AI capabilities, and maintain the trust of health plan customers, provider networks, and patients. The position operates across healthcare regulation, enterprise information security, and product innovation. It serves as Stellar’s executive security counterpart to customer CISOs and security leaders, owning customer security relationships and representing the company’s security posture. The role combines executive-level risk and governance work with hands-on security architecture reviews, risk assessments, incident response, and customer security reviews.

Requirements

13+ years of progressive experience in information security.
At least 5 years in a senior leadership role (Senior Director or above) owning security strategy and/or operations in a software product organization.
Deep expertise in healthcare or health-tech security, including hands-on experience with HIPAA, HITRUST, and regulations affecting companies handling PHI and payor data.
Demonstrated experience with threat-based or risk-based security frameworks and a risk-mitigation rather than risk-elimination philosophy.
Experience hiring, developing, and leading a small, high-performing security team in a high-growth software product environment and scaling it with business needs.
Strong executive presence and a track record of influencing peers, presenting to boards of directors, and speaking with existing and potential customers.
Experience managing security in SaaS-first, cloud-native environments; AWS is preferred.
Ability to personally adopt AI tools and lead AI adoption across a team, with measurable productivity gains and an approach to using emerging technology to scale security operations.
Expertise in AI/ML security, including data governance, model security, and third-party AI risk assessment.
Strong problem-solving skills and the credibility to disagree with senior executives, maintain appropriate risk boundaries, and reach alignment.
Ability to lead through influence and manage senior stakeholders across Engineering, Product, Finance, Legal, People, and Compliance.
Experience owning a security budget and making resource-allocation decisions that balance risk reduction with business investment.
Ability to lead security due diligence for M&A, strategic partnerships, and new business line launches, recommend remediation paths, and explain the business impact of identified risks.

Nice To Haves

CISSP, CISM, or similar certification.
HITRUST Certified CSF Practitioner (CCSFP).
HITRUST audit management experience.
Experience with CMS data-handling requirements and government payor security expectations.

Responsibilities

Own the enterprise security strategy and align it with business objectives, regulatory obligations, and customer expectations.
Provide regular reporting to the CCO and executive leadership on AI and traditional risk postures, program maturity, investment priorities, and emerging threats; provide security expertise for the CCO’s Board reporting.
Continue evolving Stellar’s threat-based risk model.
Own the security budget and resource allocation, prioritizing investments against the threat landscape and multi-year growth plan; present the investment case to executive leadership in terms of risk reduction and revenue enabled by security.
Set and oversee security standards for cloud security, application security, endpoint protection, and identity and access management.
Remain hands-on with security architecture reviews, risk assessments, incident response, and customer security reviews.
Own third-party and cyber risk management, including setting standards for vendors with access to PHI and approving, conditioning, or blocking vendors; manage the cyber insurance program with Finance and Legal.
Own incident response and business continuity readiness, including regular testing, and lead the security response to incidents.
Lead security due diligence for strategic partnerships, new payor relationships, and potential acquisitions, and ensure security risk is considered in corporate development and growth decisions.
Lead customer security reviews and enterprise due diligence requests, and represent Stellar’s security posture to health plan CISOs and procurement teams.
Ensure the security program satisfies federal and state security and privacy laws.
Lead security-side preparation for HITRUST audits, manage remediation of findings, and maintain readiness for customer security assessments and due diligence.
Monitor evolving regulatory requirements, including AI governance frameworks and state-level health data privacy laws, and communicate relevant threat and industry perspectives to executive leadership.
Develop responsible AI security practices that enable innovation while respecting contractual restrictions on data use and processing; partner with Engineering and Product to establish and enforce security guardrails for AI initiatives.
Set and enforce security standards for AI tools used across the organization, with authority to approve or restrict tools that do not meet PHI handling, data classification, contractual, or legal requirements.
Design the security function’s operating model and organizational structure; hire, develop, and lead a team with expertise in cloud security, application security, and healthcare-specific compliance.
Build a security-aware culture through training and embedded partnerships with Engineering and Product, and establish standards for secure development and operations.
Define success measures for the security function and report measurable progress.