Director, Information Security at Carrotfertility · LumiJobs

Responsibilities

Carrot is looking for a Director, Information Security to lead the security program that protects the highly sensitive fertility and family-building data of members around the world. You will set the security strategy, own both corporate security (GRC, incident response, security awareness, vendor risk) and product security (application, cloud and infrastructure security, secure development lifecycle), and serve as the trusted voice on Carrot's security posture with executives, auditors, and enterprise customers.
What makes this role different is the combination of stakes and influence. Few security leaders get to protect data this personal, at global scale, while working directly with executive leadership and shaping how a health platform is built, sold, and trusted.
What You’ll Own 💼
Lead Carrot's security strategy and roadmap, using a recognized maturity model (such as C2M2 or NIST CSF) to prioritize investments and report progress to executive leadership
Own the full security program across corporate security (GRC, incident management, security awareness, third-party risk) and product security (application security, cloud and infrastructure security, secure SDLC)
Partner with Engineering, especially the Internal Platform team, to build security into how Carrot designs, ships, and operates its systems, going beyond compliance
Lead internal risk assessments across application, cloud, and corporate environments and turn the results into prioritized technical safeguards
Own the compliance portfolio, including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA, and prepare Carrot for additional frameworks such as ISO 27001 as the business requires
Direct incident response readiness, including playbooks, tabletop exercises, executive communication, and post-incident learning
Represent Carrot's security posture to employers, health plans, and health systems through security reviews, questionnaires, and strategic sales conversations
Work with Legal and Privacy to meet global data protection requirements (HIPAA, GDPR, CCPA/CPRA) for member health data
Build, coach, and grow the security team, balancing hands-on execution with delegation as the team scales

Qualification

You likely haveA bachelor's degree in Computer Science10+ years of experience in technologyStrong knowledge of applicationWhile not requiredA background in healthcareWhy This Role Matters 🧡

Required

You likely have:
A bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent experience)
10+ years of experience in technology, including 5+ years in information security and at least 3 years leading security teams
A security certification such as CISSP or CISM
Experience leading the security function at a late-stage startup, scale-up, or public company
Working depth in healthcare data protection and privacy frameworks, including HIPAA, GDPR, and CCPA/CPRA
Experience overseeing enterprise frameworks and audits such as SOC 2 Type II, HITRUST, PCI DSS, and ISO 27001
Strong knowledge of application, network, and cloud security (AWS and Azure) and frameworks such as NIST CSF and OWASP
Experience running core security programs, including incident response, risk management, vulnerability management, penetration testing, and security awareness
Executive-level communication skills and confidence engaging customers and sales teams on security requirements
Experience managing budget and allocating resources across people, tools, and vendors

Preferred

While not required, we would be especially excited if you bring:
Experience leading security through a major company event such as an IPO, acquisition, or large-scale audit cycle
A background in healthcare, digital health, or another highly regulated, high-trust environment
Experience leading security in a remote-first, globally distributed company
Familiarity with compliance automation platforms such as Drata
Experience building a security engineering practice alongside platform and infrastructure teams
Why This Role Matters 🧡
Members trust Carrot with some of the most personal information a person can share, often during some of the most meaningful moments of their lives. Protecting that trust is not a back-office function. It is what allows employers, health plans, and health systems to bring Carrot to millions of people worldwide.

Director, Information Security

Responsibilities

Qualification

Required

Preferred

Benefits

Company

Carrotfertility

More roles at Carrotfertility