Carrot - Director, Information Security

• Lead Carrot's security strategy and roadmap, using a recognized maturity model (such as C2M2 or NIST CSF) to prioritize investments and report progress to executive leadership • Own the full security program across corporate security (GRC, incident management, security awareness, third-party risk) and product security (application security, cloud and infrastructure security, secure SDLC) • Partner with Engineering, especially the Internal Platform team, to build security into how Carrot designs, ships, and operates its systems, going beyond compliance • Lead internal risk assessments across application, cloud, and corporate environments and turn the results into prioritized technical safeguards • Own the compliance portfolio, including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA, and prepare Carrot for additional frameworks such as ISO 27001 as the business requires • Direct incident response readiness, including playbooks, tabletop exercises, executive communication, and post-incident learning • Represent Carrot's security posture to employers, health plans, and health systems through security reviews, questionnaires, and strategic sales conversations • Work with Legal and Privacy to meet global data protection requirements (HIPAA, GDPR, CCPA/CPRA) for member health data • Build, coach, and grow the security team, balancing hands-on execution with delegation as the team scales • What Success Looks Like  📈 • What Success Looks Like • In your first 12–18 months, you will have: • A documented, executive-endorsed security strategy and multi-year roadmap with clear priorities, owners, and measures of progress • Clean outcomes on recurring audits and certifications (SOC 2 Type II, HITRUST, PCI DSS), with remediation items closed on schedule • A tested incident response program, with regular tabletop exercises completed and lessons learned built back into the program • A measurable reduction in high-risk vulnerabilities and open security findings, with remediation timelines agreed on with Engineering • A living risk register and vendor security review process that leaders rely on to make decisions • A security team with defined roles, clear growth paths, and the right capacity for Carrot's growth, including key hires made • Faster, more consistent security reviews for Sales and Customer Success, with fewer escalations from enterprise customers • A clear plan, and visible progress, on any additional frameworks the business prioritizes, such as ISO 27001 • You likely have: • A bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent experience) • 10+ years of experience in technology, including 5+ years in information security and at least 3 years leading security teams • A security certification such as CISSP or CISM • Experience leading the security function at a late-stage startup, scale-up, or public company • Working depth in healthcare data protection and privacy frameworks, including HIPAA, GDPR, and CCPA/CPRA • Experience overseeing enterprise frameworks and audits such as SOC 2 Type II, HITRUST, PCI DSS, and ISO 27001 • Strong knowledge of application, network, and cloud security (AWS and Azure) and frameworks such as NIST CSF and OWASP • Experience running core security programs, including incident response, risk management, vulnerability management, penetration testing, and security awareness • Executive-level communication skills and confidence engaging customers and sales teams on security requirements • Experience managing budget and allocating resources across people, tools, and vendors