Remote opportunity at
CarrotDirector, Information Security
Carrot is seeking a Director, Information Security to lead the security program protecting sensitive fertility and family-building data for members globally. Carrot operates a leading global…
Career Tools
About This Role
Carrot is seeking a Director, Information Security to lead the security program protecting sensitive fertility and family-building data for members globally. Carrot operates a leading global fertility and family care platform, trusted by multinational employers, health plans, and health systems across 195 countries. This role suits a security leader who wants to combine strategy with hands-on execution, guiding corporate and product security while working closely with executive leadership, engineering, and…
Job Description
Carrot is seeking a Director, Information Security to lead the security program protecting sensitive fertility and family-building data for members globally. Carrot operates a leading global fertility and family care platform, trusted by multinational employers, health plans, and health systems across 195 countries. This role suits a security leader who wants to combine strategy with hands-on execution, guiding corporate and product security while working closely with executive leadership, engineering, and enterprise customers.
The person in this position will establish the security strategy, manage risk across application, cloud, and corporate environments, and direct audit and compliance cycles for frameworks like SOC 2 Type II, HITRUST, PCI DSS, and HIPAA. Responsibilities also include leading incident response readiness, managing third-party vendor risk, and mentoring a talented team. Carrot already possesses a strong compliance foundation, allowing the incoming director to focus on taking program maturity to the next level.
Responsibilities
- Lead Carrot's security strategy, multi-year roadmap, and risk prioritization using maturity models like C2M2 or NIST CSF
- Oversee corporate security including GRC, incident management, security awareness, and third-party risk
- Manage product security covering application, cloud, infrastructure security, and the secure SDLC
- Collaborate with the Internal Platform team within Engineering to integrate security into system design and operations
- Conduct internal risk assessments across cloud, application, and corporate environments to establish prioritized technical safeguards
- Direct compliance portfolios and prepare the business for new frameworks such as ISO 27001
- Maintain incident response readiness through playbooks, tabletop exercises, executive communication, and post-incident reviews
- Represent the organization's security posture to health plans, employers, and health systems during sales conversations and security reviews
- Partner with Legal and Privacy teams to satisfy global data protection regulations like HIPAA, GDPR, and CCPA/CPRA
- Coach and expand the security team while managing budgets, tooling, and vendor relationships
Requirements
- 10 or more years of experience in technology
- At least 5 years of experience specifically in information security
- Minimum 3 years of experience leading security teams
- Background working with healthcare data protection and privacy frameworks including HIPAA, GDPR, and CCPA/CPRA
- Experience overseeing enterprise frameworks and audits such as SOC 2 Type II, HITRUST, PCI DSS, and ISO 27001
- Expertise in network, application, and cloud security across AWS and Azure alongside frameworks like NIST CSF and OWASP
- Experience running core security programs including incident management, risk management, vulnerability management, penetration testing, and security awareness
- Executive communication skills with the ability to engage customers and sales teams regarding security needs
- Experience managing budgets and resource allocation across personnel, tools, and vendors
Qualifications
- Bachelor degree in Information Technology, Computer Science, or a related discipline
- A recognized security certification such as CISSP or CISM
- Experience leading security through major events such as acquisitions, IPOs, or large-scale audit cycles
- Background in digital health, healthcare, or other highly regulated and high-trust sectors
- Experience managing security within a globally distributed, remote-first organization
- Familiarity with compliance automation software such as Drata
- Experience building security engineering practices alongside platform and infrastructure teams
Core Skills
Benefits
- Competitive compensation and equity
- Comprehensive health and wellness benefits
- Retirement savings plans
- Short-term and long-term incentives
- Parental leave and family-forming assistance
- Flexible Time Off
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the salary range for the Director, Information Security position?
The starting base salary ranges from USD 188,000 to 245,000 per year, with actual compensation varying based on confirmed job-related skills and experience.
What are the core experience requirements for applicants?
Candidates must have at least 10 years of experience in technology, including a minimum of 5 years in information security and at least 3 years leading security teams. A security certification such as CISSP or CISM is also required.
What compliance frameworks does Carrot currently maintain?
Carrot has earned SOC 2 Type II, HIPAA, HITRUST, and PCI DSS compliance.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.