Chief Information Security Officer (CISO)

About the role

Please note that Insurity will only reach out to interview, make an offer of employment, or conduct onboarding activities for candidates who have applied through our careers site. When interviewing for a position, the candidate experience will include live interaction, such as a video or telephone call, with a Recruiter and/or company employee(s).

We will never ask for any money or payments from applicants at any point in the recruitment process. Recruiters will only reach out from an insurity.com email address; no other email addresses will be used. Examples of fraudulent email addresses that have been used end with @insurityjobs.us. Be aware of suspicious recruitment activity.

Insurity's Next Chief Information Security Officer (CISO)

Insurity is seeking a strategic, operational, and technically credible Chief Information Security Officer to lead Insurity's enterprise security, cybersecurity risk and privacy programs.

The CISO will protect Insurity's information assets, products, customer environments, and technology ecosystem while enabling growth, cloud adoption, international expansion, and responsible use of artificial intelligence. This leader will translate cybersecurity, privacy, compliance, and technology risk into clear business decisions for executive leadership and the Board.

The successful candidate will combine executive presence with practical execution. They need to be comfortable setting strategy, leading through influence, engaging with customers executives and regulators, directing major incidents, reviewing architecture, and building the processes, team, and culture required for a growing SaaS company.

What Our Chief Information Security Officer (CISO) Will Do

Enterprise security strategy and governance

• Develop, implement, and continuously improve Insurity's enterprise information security strategy, policies, standards, and control framework.
• Establish security priorities that align with business strategy, product roadmaps, customer commitments, and the organization's risk appetite.
• Reinforce an enterprise security governance structure, including executive steering forums and appropriate reporting to the executive team and Board of Directors.
• Define clear accountability for security across Engineering, Product, Corporate IT, Cloud Operations, Legal, Privacy, and Compliance business functions.
• Provide risk-mitigating direction for initiatives with technology, data, cloud, product, or customer-security implications.
• Maintain a forward-looking view of emerging threats, technologies, regulations, and business risks.

HIPAA, PHI data protection

• Own and mature Insurity's HIPAA compliance and electronic protected health information program where applicable to Insurity's products, services, customers, vendors, and business operations.
• Lead documented HIPAA risk analyses, risk treatment plans, control testing, remediation tracking, and periodic program evaluations.
• Ensure appropriate administrative, physical, and technical safeguards for protected health information, including access control, authentication, audit controls, integrity, transmission security, encryption, contingency planning, and workforce security.
• Partner with Legal, Privacy, Compliance, Product, and Customer Success on the HIPAA Privacy, Security, and Breach Notification Rules.
• Establish requirements for Business Associate Agreements, customer obligations, subcontractors, cloud providers, and other third parties that create, receive, maintain, or transmit PHI.
• Maintain audit-ready evidence and support customer diligence, independent assessments, regulatory inquiries, and OCR requests.
• Lead the security component of PHI breach assessment, containment, investigation, notification coordination, and post-incident remediation.
• Ensure HIPAA-specific workforce training, sanctions, and awareness requirements are incorporated into the broader security program.

AI security, governance, and responsible adoption

• Establish and lead Insurity's enterprise AI security and governance program.
• Maintain an inventory of AI, machine learning, large language model, generative AI, and agentic systems used, developed, procured, or embedded in Insurity products and operations.
• Define AI intake, risk classification, ownership, approval gates, prohibited uses, and human-oversight requirements.
• Establish secure-use standards for generative AI, including requirements for confidential information, PHI, PII, customer data, source code, proprietary data, prompts, outputs, retention, and model training.
• Define controls for AI-specific risks, including prompt injection, data leakage, insecure agents and tools, model abuse, data poisoning, supply-chain risk, unauthorized access, and unreliable or harmful outputs.
• Partner with Legal, Privacy, Product, Engineering, Data, and Compliance to address transparency, intellectual property & data rights of emerging AI regulations.
• Incorporate AI security and governance requirements into procurement, third-party risk management, secure development, cloud architecture, product reviews, and customer commitments.

Risk management, compliance, and assurance

• Develop a risk-based process for identifying, assessing, prioritizing, treating, and accepting information security and technology risks across Insurity's ecosystem.
• Maintain alignment with applicable requirements and leading practices, including HIPAA, SOC 2, ISO/IEC 27001, GDPR & the NIST Cybersecurity Framework.
• Orchestrate internal and external audits through planning, evidence collection, testing, findings management, remediation, and executive reporting.
• Establish control ownership, evidence standards, issue-management processes, and sustainable remediation tracking.
• Advise management on the costs, value, and risks of security and technology investments.
• Support cyber-insurance requirements, underwriting reviews, claims preparation, and risk-improvement initiatives.
• Monitor regulatory and contractual changes and translate them into practical requirements, policies, and implementation plans.
• Report material risks, exceptions, incidents, and remediation plans to executive leadership and the Board.

Security operations and incident response

• Lead the enterprise security operations program, including monitoring, threat intelligence, vulnerability management, detection and response, penetration testing, and security investigations.
• Manage security incident response coordinating both internally and externally from inception to resolution.
• Maintain an incident response program that covers cyber incidents, privacy events, PHI incidents, ransomware, cloud compromise, insider threats, supply-chain events, and AI-related incidents.
• Lead security incident response partnering with Insurity's COO and CLO while remaining sufficiently engaged in technical and operational details.
• Establish escalation criteria, severity definitions, communications protocols, evidence-preservation practices, and post-incident review requirements.
• Coordinate with Legal, Privacy, Compliance, Communications, customers, insurers, law enforcement, and regulators as appropriate.
• Measure response effectiveness through exercises, lessons learned, time-to-detect, time-to-contain, time-to-recover, and remediation completion.
• Lead regular cyber crisis tabletop exercises and simulations with executive leadership, key operational teams, customers, and external partners where appropriate.
• Maintain crisis communications and breach-disclosure playbooks in partnership with Legal, Communications, Privacy, and executive leadership.
• Ensure lessons from incidents and exercises are converted into funded improvements.

Product, application, cloud, and infrastructure security

• Embed security-by-design into product development, architecture, engineering, DevOps, and change-management processes.
• Establish and oversee application security practices, including secure coding, threat modeling, SAST, DAST, software composition analysis, penetration testing, vulnerability disclosure, and release gates.
• Lead software supply-chain security, including dependency governance, SBOMs, artifact integrity, code-signing expectations, CI/CD controls, and third-party component risk.
• Oversee cloud-security architecture, identity and access management, encryption, secrets management, network segmentation, logging, monitoring, data-loss prevention, and secure configuration management.
• Promote Zero Trust principles, least privilege, strong authentication, secure-by-default configurations, and continuous control monitoring.
• Review and approve security architecture for major products, platforms, infrastructure changes, AI systems, and customer-facing capabilities.

Third-party risk, customer trust, and commercial enablement

• Establish a risk-based third-party security and privacy program covering vendors, cloud providers, subprocessors, partners, supply-chain participants, and other external parties.
• Ensure contracts, security requirements, audit rights, breach obligations, data-use restrictions, and Business Associate obligations are addressed with Legal and Procurement.
• Establish and maintain data classification, data inventory, data-flow, retention, deletion, residency, and access-governance practices.
• Ensure security requirements are addressed across the lifecycle of customer, employee, regulated, confidential, and proprietary information.

Leadership, organization, and culture

• Build and lead a cost-efficient, high-performing security organization with appropriate direct and dotted-line relationships across Engineering, Product, IT, Cloud Operations, Privacy, Compliance, and other functions.
• Hire, develop, coach, and retain security talent while establishing clear operating rhythms and accountability.
• Create and manage security awareness and role-based training for employees, contractors, approved system users, developers, administrators, and executives.
• Promote a culture in which security is viewed as an enabler of customer trust, product quality, resilience, and business growth.
• Manage the security budget, partner strategy, managed service providers, and external security resources.
• Define and report meaningful security metrics, risk indicators, maturity measures, control health, remediation progress, incident trends, audit results, customer commitments, and AI-governance metrics.

Who We're Looking For

• A strategic leader and builder who can establish vision, create alignment, and execute through influence.
• A credible executive communicator who can brief the Board, lead a crisis, engage customers, and explain complex issues in simple terms.
• A pragmatic security leader who balances risk reduction, business enablement, customer commitments, speed, and cost.
• A collaborative partner to Engineering, Product, IT, Legal, Privacy, Compliance, Finance, Sales, Customer Success, and executive leadership.
• A calm, decisive leader who can operate effectively in high-pressure, high-stakes situations.
• A leader who is comfortable working hands-on when necessary while building a scalable team and operating model.

Required qualifications and experience

• Bachelor's degree in information security, computer science, information technology, business, or a related field; equivalent experience may be considered.
• 8-10 years of progressive experience in information security, cybersecurity, technology risk, or related disciplines within a SaaS, cloud, technology, insurance, healthcare, or other regulated environment.
• At least 5 years of executive or senior leadership experience in a CISO, Deputy CISO, Head of Security, or comparable role.
• Demonstrated experience building and operating an enterprise security program across a distributed or remote organization.
• Experience with HIPAA, ePHI, Business Associate requirements, healthcare data protection, or comparable regulated-data obligations.
• Demonstrated experience leading security risk assessments, audits, remediation programs, and regulatory or customer assurance activities.
• Experience leading material incidents, crisis response, business continuity, disaster recovery, and executive communications.
• Experience establishing or operating an AI security, AI governance, responsible AI, model-risk, or secure-generative-AI program.
• Strong understanding of cloud, SaaS operating models, identity, encryption, application security, vulnerability management, incident response, and third-party risk.
• Exceptional written, verbal, presentation, negotiation, and stakeholder-influencing skills.
• Demonstrated ability to manage budgets, partners, vendors, priorities, and complex cross-functional programs.

Preferred qualifications

• CISSP, CISM, CISA, CRISC, CCSP, or equivalent certification.
• Experience with SOC 2 Type II, ISO/IEC 27001, NIST CSF, NIST AI RMF, or comparable frameworks.
• Experience with AI/ML security, LLM security, agent security, model risk management, AI impact assessments, or AI red teaming.
• Experience supporting customer security reviews, RFPs, renewals, and executive-level trust discussions.
• Experience in insurance technology, property and casualty insurance, healthcare technology, or another data-intensive regulated industry.
• Experience with cyber-risk quantification, cyber insurance, secure software supply chains, DevSecOps, and cloud-native security.

What's In It For U

Work Where You Thrive

Find the work environment that supports your best-whether that's remote, in-office, or hybrid-depending on your role and location. Our Flex First Workforce approach offers many fully remote opportunities, while some teams follow hybrid or in-office schedules to stay connected and collaborative.

Take Time When You Need It

We trust our team to manage their time with our Open PTO Policy, empowering you to recharge when it matters most.

Benefits That Start on Day One

Enjoy comprehensive health coverage and employer-matched retirement savings right from your first day-because we know how important these are to you.

Award-Winning Onboarding

From your first day to your first anniversary, our onboarding program is designed to set you up for success and help you make an immediate impact.

Grow Your Career from Within

We believe in promoting from within. In fact, over 25% of our open roles are filled by internal candidates.

Mentorship That Matters

Our mentorship program connects you with experienced leaders who are committed to helping you grow both personally and professionally.

Insurity Podcasts

Explore podcasts from our Learning & Development team for deeper insight into Insurity products, company innovation, and the business as a whole.

Keep Learning, Always

Fuel your growth with full access to LinkedIn Learning and Kaplan-because continuous development is key to success.

Invest in Your Future-And Your Family's

Through our partnership with the University of Arizona Global Campus, you and your family can access discounted tuition and pursue educational goals affordably.

Earn When You Refer

Love where you work? Invite others to join us! Our Employee Referral Bonus program rewards you for bringing great people on board.

We have five Core Values at Insurity; one of which is to Act with Integrity. Providing pay transparency helps you make the best decision for you. We continuously analyze and update our salary ranges for our roles according to market trends to not only ensure our employees are paid fairly, but also help close gender, race, and disability wage gaps.

Along with the benefits listed above, the career level salary range for this role is $216,000 to $325,000. We share a career level salary as a guideline; however, actual salary may vary based on your experience and qualifications. If your application advances, your recruiter will review these details with you during a video interview.

Languages for Québec candidates: The knowledge of French is required for positions permanently located in Quebec. The English language is required for this position in order to communicate with clients, partners, and colleagues, who are strictly located outside of Québec. French-language training will be offered to candidates who do not have a good knowledge of French.