About the role
Responsibilities Lead the security strategy and roadmap, reporting progress to executive leadership Own corporate security (GRC, incident management, security awareness, third-party risk) and product security (application, cloud, infrastructure, secure SDLC) Partner with Engineering to build security into design, shipping and operations Lead internal risk assessments and turn results into prioritized safeguards Own the compliance portfolio: SOC 2 Type II, HITRUST, PCI DSS, HIPAA, and prepare for ISO 27001 Direct incident response readiness, playbooks and tabletop exercises Represent security posture to employers, health plans and health systems Work with Legal and Privacy on HIPAA, GDPR and CCPA/CPRA requirements Build, coach and grow the security team Manage the security budget, tooling and vendors Requirements Bachelor's degree in Computer Science, IT or related field, or equivalent experience 10+ years in technology, including 5+ years in information security and 3+ years leading security teams CISSP or CISM certification Experience leading security at a late-stage startup, scale-up or public company Working depth in HIPAA, GDPR and CCPA/CPRA Experience with SOC 2 Type II, HITRUST, PCI DSS and ISO 27001 audits Strong knowledge of application, network and cloud security (AWS, Azure), NIST CSF and OWASP Experience running incident response, risk management, vulnerability management, penetration testing and security awareness Executive-level communication skills Experience managing budget and resources Preferred Qualifications Leading security through an IPO, acquisition or large audit cycle Background in healthcare, digital health or highly regulated environments Experience leading security in a remote-first, global company Familiarity with compliance automation platforms such as Drata Experience building a security engineering practice Benefits Competitive compensation and equity Comprehensive health and wellness benefits Flexible time off Comprehensive parental leave and family-forming benefits About the Company Carrot is a global fertility and family care platform serving over a thousand employers, health plans and health systems across 195 countries.