Director, Information Security

• Own the full security program across corporate security (GRC, incident management, security awareness, third-party risk) and product security (application security, cloud and infrastructure security, secure SDLC)

• Partner with Engineering, especially the Internal Platform team, to build security into how Carrot designs, ships, and operates its systems, going beyond compliance

• Lead internal risk assessments across application, cloud, and corporate environments and turn the results into prioritized technical safeguards

• Own the compliance portfolio, including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA, and prepare Carrot for additional frameworks such as ISO 27001 as the business requires

• Direct incident response readiness, including playbooks, tabletop exercises, executive communication, and post-incident learning

• Represent Carrot's security posture to employers, health plans, and health systems through security reviews, questionnaires, and strategic sales conversations

• Work with Legal and Privacy to meet global data protection requirements (HIPAA, GDPR, CCPA/CPRA) for member health data

• Build, coach, and grow the security team, balancing hands-on execution with delegation as the team scales

• Manage the security budget, tooling, and vendor relationships, and tailor security guidance for a remote-first workforce and physical offices

What Success Looks Like 📈

In your first 12–18 months, you will have:

• A documented, executive-endorsed security strategy and multi-year roadmap with clear priorities, owners, and measures of progress

• Clean outcomes on recurring audits and certifications (SOC 2 Type II, HITRUST, PCI DSS), with remediation items closed on schedule

• A tested incident response program, with regular tabletop exercises completed and lessons learned built back into the program

• A measurable reduction in high-risk vulnerabilities and open security findings, with remediation timelines agreed on with Engineering

• A living risk register and vendor security review process that leaders rely on to make decisions

• A security team with defined roles, clear growth paths, and the right capacity for Carrot's growth, including key hires made

• Faster, more consistent security reviews for Sales and Customer Success, with fewer escalations from enterprise customers

• A clear plan, and visible progress, on any additional frameworks the business prioritizes, such as ISO 27001

About You ✨

You likely have:

• A bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent experience)

• 10+ years of experience in technology, including 5+ years in information security and at least 3 years leading security teams

• A security certification such as CISSP or CISM

• Experience leading the security function at a late-stage startup, scale-up, or public company

• Working depth in healthcare data protection and privacy frameworks, including HIPAA, GDPR, and CCPA/CPRA

• Experience overseeing enterprise frameworks and audits such as SOC 2 Type II, HITRUST, PCI DSS, and ISO 27001

• Strong knowledge of application, network, and cloud security (AWS and Azure) and frameworks such as NIST CSF and OWASP

• Experience running core security programs, including incident response, risk management, vulnerability management, penetration testing, and security awareness

• Executive-level communication skills and confidence engaging customers and sales teams on security requirements

• Experience managing budget and allocating resources across people, tools, and vendors

Nice to Have ⭐

While not required, we would be especially excited if you bring:

• Experience leading security through a major company event such as an IPO, acquisition, or large-scale audit cycle

• A background in healthcare, digital health, or another highly regulated, high-trust environment

• Experience leading security in a remote-first, globally distributed company

• Familiarity with compliance automation platforms such as Drata

• Experience building a security engineering practice alongside platform and infrastructure teams

Why This Role Matters 🧡

Members trust Carrot with some of the most personal information a person can share, often during some of the most meaningful moments of their lives. Protecting that trust is not a back-office function. It is what allows employers, health plans, and health systems to bring Carrot to millions of people worldwide.

As Carrot grows, security leadership shapes how we build, how we sell, and how we show up for customers. In this role, you will make security a strength that members and customers can see and rely on, and build a team that keeps raising the bar as the business scales.

Why Candidates Join Carrot 🌍

Carrot offers the opportunity to do meaningful work in service of a deeply human mission.

Highlights include:

• A mission-driven company focused on expanding access to fertility and family-forming care globally.

• A high-growth environment where leaders are empowered to shape strategy and drive impact.

• Competitive compensation, equity, and comprehensive benefits.

• Flexible Time Off and a culture that actively encourages employees to recharge.

• Comprehensive parental leave and family-forming benefits.

• A collaborative, inclusive, and values-driven culture.

• The opportunity to work alongside passionate, thoughtful teammates committed to improving healthcare outcomes worldwide.

Compensation:

Carrot offers a holistic Total Rewards package designed to support our employees in all aspects of their lives inside and outside of work, including health and wellness benefits, retirement savings plans, short- and long-term incentives, parental leave, family-forming assistance, and a competitive compensation package. The starting base salary for this position will range from $188,000.00 - $245,000.00. Actual compensation may vary from posted base salary depending on your confirmed job-related skills and experience.

Fraud and Security Notice: Please note that all communication regarding job opportunities at Carrot will come exclusively from an @get-carrot.com email address. If you receive messages from any other domain, please disregard them and report the incident to:

A Note on AI

At Carrot, we believe AI can help us work smarter, move faster, and create more meaningful experiences for our members, customers, and each other. While not every role requires deep technical AI expertise, we value people who are curious, eager to learn, and excited to thoughtfully incorporate AI into their day-to-day work.

For some roles, AI fluency is a core requirement—and we'll call that out clearly in the qualifications. For everyone else, we're looking for people who embrace new ways of working, use AI responsibly to improve quality and efficiency, and continue to learn as the technology evolves.

Why Carrot?

Carrot has received national and international recognition for its pioneering work, including Fast Company's Most Innovative Companies and World Changing Ideas, Inc. Power Partners, and Modern Healthcare’s Innovators. Carrot’s global workforce has been acknowledged with several accolades, including Fortune’s Best Workplaces in Healthcare, Great Place to Work, and Age-Friendly Employer certifications. Carrot is regularly featured in media reporting on issues related to the future of work, women in leadership, and healthcare innovation, including MSNBC, The Economist, Bloomberg, The Wall Street Journal, CNBC, National Public Radio, Harvard Business Review, and more. Learn more at carrotfertility.com.

Originally posted on Himalayas

• Information Security Director
• Security Director
• Cybersecurity Director
• Chief Information Security Officer

Source: Himalayas