Director, Information Security

The role

You will lead the security program to protect sensitive fertility and family-building data. You will set security strategy and own both corporate and product security.

What you will do

• Lead Carrot's security strategy and roadmap
• Own the full security program across corporate and product security
• Partner with Engineering to build security into system design and operations
• Lead internal risk assessments across application, cloud, and corporate environments
• Own the compliance portfolio including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA
• Direct incident response readiness
• Represent Carrot's security posture to employers, health plans, and health systems
• Work with Legal and Privacy to meet global data protection requirements
• Build, coach, and grow the security team
• Manage the security budget, tooling, and vendor relationships

Required qualifications

• Bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent experience)
• 10+ years of experience in technology
• 5+ years in information security
• At least 3 years leading security teams
• Security certification such as CISSP or CISM
• Experience leading the security function at a late-stage startup, scale-up, or public company
• Working depth in healthcare data protection and privacy frameworks, including HIPAA, GDPR, and CCPA/CPRA
• Experience overseeing enterprise frameworks and audits such as SOC 2 Type II, HITRUST, PCI DSS, and ISO 27001
• Strong knowledge of application, network, and cloud security (AWS and Azure) and frameworks such as NIST CSF and OWASP
• Experience running core security programs, including incident response, risk management, vulnerability management, penetration testing, and security awareness
• Executive-level communication skills
• Experience managing budget and allocating resources across people, tools, and vendors

Nice to have

• Experience leading security through a major company event such as an IPO, acquisition, or large-scale audit cycle
• A background in healthcare, digital health, or another highly regulated, high-trust environment
• Experience leading security in a remote-first, globally distributed company
• Familiarity with compliance automation platforms such as Drata
• Experience building a security engineering practice alongside platform and infrastructure teams

Benefits

• Competitive compensation
• Equity
• Comprehensive benefits
• Flexible Time Off
• Comprehensive parental leave
• Family-forming benefits
• Health and wellness benefits
• Retirement savings plans
• Short- and long-term incentives

About the company

Carrot is the leading global fertility and family care platform. The company supports millions of members across 195 countries through a comprehensive clinical program.