Director, Information Security + Compliance

New York, NY · New York · USD 210,000-230,000 · Hybrid · Posted Oct 8, 2026

At a glance

Our engineering team operates as empowered, outcome-oriented problem solvers, working in close partnership with product, design, and clinical teams to improve member outcomes at scale.
As AI transforms how software is built, we are intentionally evolving our development lifecycle so we spend less time on mechanical implementation and more time on system design, judgment, and impact.

The Director of Information Security & Compliance will keep Pelago's security foundation strong as the business, data, and AI platform grow, setting the security strategy and leading the team that executes it. This role requires owning accreditation outcomes in a regulated environment, hands-on execution alongside a small team, and commercial judgment to accelerate deals.

Own SOC 2 Type II and HITRUST certification end to end, including audits, remediation, and recertification.
Develop and manage Pelago's security roadmap, budget, and tooling, and present key risks and recommendations to the executive team and Board.
Serve as the security lead in client security reviews, RFPs, questionnaires, and partner due diligence, partnering with Sales to position our security posture as a competitive advantage.
Maintain security policies and third-party vendor risk reviews, including reviews of new AI tools.
Automate evidence collection and implement continuous control monitoring so compliance scales with the business.
Own incident response, vulnerability management, and the penetration testing program.
Partner with Engineering on security monitoring, disaster recovery, secure design, and the security of our AI platform.
Partner with IT on identity and access management, and own the periodic access reviews our audits depend on.
Partner with Legal on the privacy program (HIPAA, GDPR, BAAs) and lead breach assessments.
Lead, coach, and grow the security team as a player-coach, building the case for and hiring the next people onto the team.

Direct accountability for SOC 2 Type II and HITRUST outcomes.
Experience leading information security and compliance in healthcare, health tech, or another regulated industry; strong working knowledge of HIPAA.
Cloud security expertise in a modern stack (AWS, infrastructure as code, containers, CI/CD).
Working knowledge across GRC, security operations, application security, and identity and access management.
Player-coach leadership experience: hands-on in the work while building a team.
Sound judgment about risk in a commercial context, including when to accept risk and when to escalate.
Ability to communicate clearly with engineers, clients, auditors, executives, and the Board

Experience securing AI/LLM systems, agentic tools, or data used in model workflows.
Experience scaling a security program at a Series B or C company.
Certifications such as CISSP, CISM, CCSP, or HITRUST CCSFP.
Experience working with US health plans, PBMs, or large self-insured employers.

Generous and meaningful equity package
Full Medical, Dental, & Vision coverage
401k Plan
Unlimited PTO Policy, 10 paid holidays, & company wide "Me Time" Days
Paid maternity, paternity & new parent leave
Flexible working environment
Annual Learning and Development stipend to support continued learning and career development
Wellness Reimbursement Program
Access to Reproductive & Family Planning Care
Substance Use Support for employees and family members

This is a hybrid role with a high-collaboration rhythm (3 days/week in our NYC office).