Director, Information Security
Carrotfertility · Remote
About this role
**Director, Information Security — Carrot Fertility** **About Carrot** Carrot is a global fertility and family care platform that delivers intelligent care orchestration—providing the right clinical guidance at the right moment for each member’s life. Trusted by multinational employers, health plans, and health systems across **195 countries**, Carrot supports members from pre-pregnancy through menopause and major life moments in between. **The Opportunity** Carrot is seeking a **Director, Information Security** to lead a security program protecting highly sensitive fertility and family-building data worldwide. You’ll set the security strategy and own both **corporate security** (GRC, incident response, security awareness, vendor risk) and **product security** (application, cloud, and infrastructure security, secure SDLC). You’ll also be the trusted security voice for executives, auditors, and enterprise customers. **What You’ll Own** - Lead Carrot’s **security strategy and roadmap** using a maturity model (e.g., C2M2 or NIST CSF) - Own the full security program across **corporate** and **product** security - Partner with Engineering (especially the **Internal Platform** team) to build security into how systems are designed, shipped, and operated - Lead internal **risk assessments** and translate results into prioritized safeguards - Own the **compliance portfolio** (SOC 2 Type II, HITRUST, PCI DSS, HIPAA) and help prepare for additional frameworks (e.g., **ISO 27001**) - Direct **incident response readiness** (playbooks, tabletop exercises, executive comms, post-incident learning) - Represent Carrot’s security posture in **security reviews** and strategic customer conversations - Partner with **Legal and Privacy** to meet global data protection requirements (HIPAA, GDPR, CCPA/CPRA) - Build, coach, and grow the security team; balance hands-on execution with delegation - Manage security **budget, tooling, and vendors** for a remote-first workforce and physical offices **What Success Looks Like (First 12–18 Months)** - An executive-endorsed security strategy and multi-year roadmap with clear priorities and measures - Strong outcomes on recurring audits/certifications, with remediation closed on schedule - A tested incident response program with regular tabletop exercises and continuous improvement - Reduced high-risk vulnerabilities and open security findings, with agreed remediation timelines - A living risk register and vendor security review process leaders rely on - A security team with defined roles, growth paths, and capacity for Carrot’s growth - Faster, more consistent security reviews for Sales/Customer Success with fewer escalations - Visible progress toward any additional frameworks prioritized by the business (e.g., ISO 27001) **About You** - Bachelor’s degree in CS/IT (or equivalent experience) - **10+ years** in technology, including **5+ years** in information security and **3+ years** leading security teams - Security certification such as **CISSP** or **CISM** - Experience leading security at a late-stage startup/scale-up/public company - Depth in healthcare data protection & privacy frameworks (HIPAA, GDPR, CCPA/CPRA) - Experience with enterprise frameworks and audits (SOC 2 Type II, HITRUST, PCI DSS, ISO 27001) - Strong knowledge of application, network, and cloud security (AWS/Azure), plus NIST CSF and OWASP - Experience running core security programs (incident response, risk/vulnerability management, pen testing,
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.