Prompt - Senior Director, Information Security
Requirements
• 8+ years of experience in information security, risk management, compliance, or related disciplines, including meaningful leadership responsibility. • Deep practical knowledge of HIPAA/HITECH and healthcare security and compliance requirements, ideally within a covered entity or business associate environment. • Strong working knowledge of cloud security, application security, IAM, vulnerability management, endpoint security, secure SDLC practices, and modern SaaS architecture. • Demonstrated experience leading SOC 2 Type II or comparable certification and assurance programs. • Experience building or materially improving information security governance, control environments, policy frameworks, audit readiness, and cross-functional accountability. • Strong working knowledge of AI security, governance, and risk management, including risks associated with sensitive data and emerging AI technologies. • Ability to engage credibly with technical leaders, evaluate proposed approaches, identify material risk, and translate technical issues into business, compliance, and customer impact. • Strong executive judgment and communication skills, with the ability to work effectively across Legal, Engineering, Product, IT, AI, People, Finance, auditors, customers, and executive leadership. • Demonstrated ability to drive accountability across functions without relying solely on direct reporting relationships. • Relevant certifications such as CISSP, CISM, CRISC, CISA, CHC, or similar are preferred but not required where equivalent experience is demonstrated.
Responsibilities
• Serve as the company’s designated HIPAA Security Officer, leading the company’s information security program and partnering with Legal, Privacy, Compliance, Engineering, IT, and other stakeholders on related requirements. • Maintain sufficient technical depth to independently assess cloud architectures, application architectures, CI/CD pipelines, infrastructure-as-code, identity and access models, software supply-chain controls, and security monitoring approaches, while technical teams retain responsibility for detailed implementation and operations. • Own HIPAA Security Rule compliance, including the Security Risk Analysis, security risk-management plan, and ongoing oversight of required safeguards. • Own the company’s SOC 2 Type II program and other security certifications, attestations, and assurance programs, including control governance, audit readiness, evidence sufficiency, auditor relationships, identified deficiencies, remediation, and successful completion of audits and assessments. • Own the company’s information-security policy and control framework, including policy development, review, exceptions, ongoing governance, and alignment with applicable regulatory, contractual, and business requirements. • Establish clear ownership for security controls across the organization and ensure deficiencies, vulnerabilities, risks, and remediation plans are identified, prioritized, tracked, validated, and appropriately escalated. • Partner with Engineering, DevOps, architecture, and IT leaders to evaluate security approaches and ensure technical controls appropriately address identified requirements, while technical teams retain responsibility for detailed design and implementation. • Establish and oversee the company’s vulnerability-management and application-security programs, including expectations for vulnerability identification, penetration testing, secure software development practices, security testing, remediation, exceptions, and escalation. • Own the security incident-response framework and coordinate the company’s response to security incidents, partnering with technical teams on investigation and remediation and with Legal, Privacy, Compliance, and executive leadership on broader incident assessment and response. • Lead the security aspects of third-party risk management, enterprise customer diligence, audits, RFPs/RFIs, and security escalations. • Partner with Product, AI, Engineering, Legal, and other stakeholders to establish appropriate governance for emerging technologies and the use of sensitive data. • Establish and oversee secure SDLC and software supply-chain requirements, including source-control protections, CI/CD security, dependency and container security, infrastructure-as-code security, secrets management, security testing, artifact integrity, release controls, vulnerability remediation, and risk-based security gates. • Maintain appropriate visibility into the effectiveness of the company’s security controls and partner with responsible technical owners to evaluate areas including access controls, data protection, cloud and application security, logging, monitoring, and business continuity. • Oversee the effectiveness of the company’s security controls and provide executive leadership with appropriate visibility into significant risks, remediation progress, and emerging security concerns. • Continuously improve the company’s information-security operating model so that requirements are clear, ownership is durable, and controls operate effectively in practice.
Benefits
• Big Challenges: Here at Prompt, we are solving complex and unique problems that have plagued the healthcare industry since the dawn of time. • Talented People: Prompt didn't happen by chance, it's a team of incredibly talented and proven individuals who all made their mark before joining forces to build the greatest software on the planet for rehab therapists. • Healthy Approach: This isn't an investment bank. At Prompt you own your workload and the entire organization takes a liking to smart work (over hard work). • Positive Impact: Prompt helps outpatient rehab organizations treat more patients and deliver better care with less environmental waste. That means less surgery and less narcotic-based pain treatment, all while turning a paper-heavy industry digital. • Competitive salaries • Remote/hybrid environment • Potential equity compensation for outstanding performance • Company-wide sponsored lunches • Company paid disability and life insurance benefits • Company paid family and medical leave • Medical, dental, and vision insurance benefits • Discounted pet insurance • Credits for online fitness classes/gym memberships • Recovery suite at HQ — includes a cold plunge, sauna, and shower • Here at Prompt, we are committed to fostering a fair and respectful work environment. As part of this commitment, it is our policy not to hire individuals from Prompt Customers unless they have obtained their current employer's explicit consent. We believe in upholding strong professional relationships and respecting the agreements and commitments our customers have with their employees. We appreciate your understanding and cooperation regarding this policy. If you have any questions or concerns, please don't hesitate to reach out to our People Department.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT