Director, Information Security + Compliance

The role

The Director of Information Security & Compliance will set the security strategy and lead the team executing it. This person will own SOC 2 Type II and HITRUST certifications and manage the security roadmap, budget, and tooling.

What you will do

• Own SOC 2 Type II and HITRUST certification end to end
• Develop and manage security roadmap, budget, and tooling
• Present key risks and recommendations to the executive team and Board
• Serve as security lead in client security reviews, RFPs, and due diligence
• Maintain security policies and third-party vendor risk reviews
• Automate evidence collection and implement continuous control monitoring
• Own incident response, vulnerability management, and penetration testing
• Partner with Engineering on security monitoring, disaster recovery, and AI platform security
• Partner with IT on identity and access management
• Partner with Legal on the privacy program and lead breach assessments

Required qualifications

• Direct accountability for SOC 2 Type II and HITRUST outcomes
• Experience leading information security and compliance in healthcare, health tech, or another regulated industry
• Strong working knowledge of HIPAA
• Cloud security expertise in a modern stack (AWS, infrastructure as code, containers, CI/CD)
• Working knowledge across GRC, security operations, application security, and identity and access management
• Player-coach leadership experience
• Sound judgment about risk in a commercial context
• Ability to communicate clearly with engineers, clients, auditors, executives, and the Board

Nice to have

• Experience securing AI/LLM systems, agentic tools, or data used in model workflows
• Experience scaling a security program at a Series B or C company
• Certifications such as CISSP, CISM, CCSP, or HITRUST CCSFP
• Experience working with US health plans, PBMs, or large self-insured employers

Benefits

• Generous and meaningful equity package
• Full Medical, Dental, & Vision coverage
• 401k Plan
• Unlimited PTO Policy
• 10 paid holidays
• Company wide Me Time Days
• Paid maternity, paternity & new parent leave
• Flexible working environment
• Annual Learning and Development stipend
• Wellness Reimbursement Program
• Access to Reproductive & Family Planning Care
• Substance Use Support for employees and family members

Before you apply

• Unable to offer visa sponsorship for this position

About the company

Pelago is a specialty substance use care provider that uses technology to deliver personalized treatment. They provide programs for tobacco, alcohol, opioid, cannabis, and stimulant use.