Senior Manager, IT Security

Accountabilities: Lead and Develop the Security Team: Manage, coach, and mentor a dedicated security team covering Security Operations (SecOps), Application Security (AppSec), Cloud Security (CloudSec), and Governance, Risk, and Compliance (GRC). Establish clear technical expectations, promote accountability, and support continuous professional development. Oversee Security Operations: Direct security operations capabilities, including security automation and orchestration (SOAR), infrastructure hardening, vulnerability management, and patch management coordination. Strengthen Application and Cloud Security: Participate in hands-on technical reviews, establish application security standards, and improve security controls across GitHub Actions, CI/CD pipelines, and software deployment workflows. Drive Cloud Security Architecture: Develop and maintain secure cloud infrastructure patterns, particularly within Google Cloud Platform (GCP), while supporting containerized environments and microservices architectures. Support Client Relationships and Sales Enablement: Partner with commercial, legal, and sales leadership to communicate the organization's security posture to prospective and existing enterprise customers, including major employers and health plans. Manage Security Assessments and Contracts: Review security-related contractual provisions, coordinate technical responses to complex Requests for Proposals (RFPs), and lead security discussions with client CISOs, procurement specialists, and risk management teams. Lead Customer Incident Communications: Act as a trusted technical point of contact during security incidents and critical vulnerability disclosures, translating technical findings, root causes, potential impact, and remediation plans into clear executive-level communications. Maintain Compliance and Audit Readiness: Collaborate with internal audit teams to implement and maintain technical controls aligned with SOC 2, HITRUST, and NIST frameworks, embedding security requirements into engineering processes and operational workflows. Coordinate Incident Response and Escalations: Oversee vulnerability management and security incident escalations, working closely with enterprise cyber operations and Engineering teams to ensure effective containment, remediation, and recovery. Establish Security Performance Metrics: Define, monitor, and report key Security Operations KPIs, including vulnerability remediation timelines, patch compliance, and security configuration drift. Drive Continuous Improvement: Identify opportunities to strengthen security processes, improve operational efficiency, and maintain a resilient security posture while supporting business objectives. Requirements Minimum of 7 years of progressive experience in information security, cybersecurity, or a closely related technical field. Demonstrated experience leading, coaching, and mentoring technical security engineers, ideally in a hands-on player-coach management role. Proven ability to engage directly with enterprise customer security leaders, CISOs, procurement specialists, and other senior stakeholders. Experience reviewing security-related contractual terms, supporting enterprise RFP processes, and communicating complex security requirements to external audiences. Strong hands-on technical expertise in Application Security (AppSec), including Dynamic Application Security Testing (DAST), secure Software Development Life Cycle (SDLC) practices, and CI/CD pipeline security controls. Solid experience designing, implementing, or reviewing cloud security architectures. Experience with Google Cloud Platform (GCP) is advantageous, although experience with other major cloud platforms is also relevant. Knowledge of containerized environments, microservices architectures, and modern cloud infrastructure security principles. Working knowledge of SOC 2, HITRUST, and NIST security frameworks, with practical experience implementing technical controls and supporting audits. Strong understanding of Security Operations, vulnerability management, infrastructure hardening, security automation, patch management, and incident response. Exceptional communication and presentation skills, with the ability to explain complex technical security topics to both technical and non-technical audiences. Proven crisis management capabilities, including the ability to remain composed during security incidents and communicate root causes, potential impact, and remediation strategies to executive and client stakeholders. Strong cross-functional collaboration skills, with experience partnering effectively with Engineering, Product, Legal, Sales, and executive leadership. Strategic thinking and sound decision-making abilities, balancing robust security practices with business priorities and operational efficiency. A proactive, accountable, and adaptable leadership style, with the ability to operate effectively in a dynamic and evolving technology environment. Benefits Annual Base Salary: $144,368–$216,552, depending on experience, qualifications, skills, geographic location, and internal equity. Work Arrangement: Fully remote position within the United States. Employment Type: Full-time opportunity. Leadership Opportunity: Take ownership of a dedicated security organization and influence enterprise-wide security strategy and execution. Technical Exposure: Work with modern cloud infrastructure, application security technologies, security automation, and enterprise-scale systems. Professional Impact: Contribute to protecting sensitive healthcare technology platforms and strengthening trust among major employers, health plans, and their customers. Cross-Functional Collaboration: Work closely with senior technology leadership and teams across Engineering, Product, Legal, and commercial operations. Career Development: Opportunity to shape security governance, improve technical capabilities, and drive strategic cybersecurity initiatives. Meaningful Mission: Help strengthen the security and reliability of digital healthcare experiences that support millions of users.