Remote opportunity at
CarrotDirector, Information Security
Carrot operates a global fertility and family care platform utilizing intelligent care orchestration to connect multinational employers, health plans, and health systems with clinical guidance for…
Career Tools
About This Role
Carrot operates a global fertility and family care platform utilizing intelligent care orchestration to connect multinational employers, health plans, and health systems with clinical guidance for millions of members spanning 195 countries. The organization seeks a Director, Information Security to direct its comprehensive security program and safeguard private member data worldwide. In this position, the selected professional will establish security strategies, manage both corporate and product security functions, and act…
Job Description
Carrot operates a global fertility and family care platform utilizing intelligent care orchestration to connect multinational employers, health plans, and health systems with clinical guidance for millions of members spanning 195 countries. The organization seeks a Director, Information Security to direct its comprehensive security program and safeguard private member data worldwide.
In this position, the selected professional will establish security strategies, manage both corporate and product security functions, and act as a primary representative during customer and auditor interactions. Responsibilities involve partnering with engineering teams, directing compliance audits, leading incident response planning, and managing a growing security department.
This role suits an experienced security leader with a background in digital health or regulated industries who can balance strategic planning with hands-on execution. The position offers an opportunity to protect sensitive information at scale while collaborating directly with company executives and supporting business growth.
Responsibilities
- Develop and execute the overall security strategy and multi-year roadmap utilizing frameworks such as NIST CSF or C2M2.
- Manage the complete security program encompassing corporate security, governance, risk, and compliance, security awareness, and third-party risk.
- Oversee product security including application safety, cloud and infrastructure protection, and the secure development lifecycle.
- Collaborate with the internal platform team within engineering to integrate security practices into system design and operations.
- Execute internal risk assessments across corporate, cloud, and application environments to establish prioritized technical safeguards.
- Maintain the existing compliance portfolio including HIPAA, HITRUST, SOC 2 Type II, and PCI DSS, while preparing for new frameworks like ISO 27001.
- Manage incident response readiness through playbooks, tabletop exercises, executive communication, and post-incident reviews.
- Engage with enterprise buyers, health plans, and employers during sales discussions and security evaluations.
- Collaborate with legal and privacy teams to adhere to global data protection regulations including GDPR, CCPA, and CPRA.
- Hire, mentor, and expand the security team while overseeing budgets, tooling, and vendor management.
Requirements
- Over 10 years of total experience in technology
- Minimum 5 years of experience specializing in information security
- At least 3 years of leadership experience managing security teams
- Experience leading the security function within a public company, scale-up, or late-stage startup
- Working familiarity with healthcare data privacy and protection regulations such as HIPAA, GDPR, CCPA, and CPRA
- Experience overseeing audits and enterprise frameworks like SOC 2 Type II, HITRUST, PCI DSS, and ISO 27001
- Technical knowledge spanning application, network, and cloud security across AWS and Azure
- Background executing core security functions such as vulnerability management, penetration testing, risk management, and security awareness
- Experience managing budgets and resource allocation across tools, vendors, and personnel
Qualifications
- Bachelor's degree in Information Technology, Computer Science, or a related discipline, or equivalent practical experience
- An active security certification such as CISSP or CISM
- Prior experience guiding security through a major corporate event like an IPO, acquisition, or large-scale audit
- Professional background in digital health, healthcare, or another highly regulated environment
- Experience operating security functions within a globally distributed, remote-first organization
- Familiarity utilizing compliance automation platforms such as Drata
- Experience developing a security engineering practice alongside infrastructure and platform groups
Core Skills
Benefits
- Competitive compensation package
- Equity incentives
- Comprehensive health and wellness benefits
- Retirement savings plans
- Short- and long-term incentives
- Parental leave and family-forming assistance
- Flexible Time Off
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the salary range for the Director, Information Security role?
The starting base salary for this position ranges from USD 188,000 to 245,000 per year, with actual compensation varying based on verified job-related skills and experience.
What employment type is this position?
This is a full-time employment opportunity.
What are the core educational or certification expectations for applicants?
Applicants likely have a bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent experience) along with a security certification such as CISSP or CISM.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
