Job Title: Director, Information Security
Company: Carrot, a global fertility and family care platform serving millions of members across 195 countries through multinational employers, health plans, and health systems. It holds SOC 2 Type II, HIPAA, HITRUST, and PCI DSS compliance
Job Type: Full-time
Location: Not specified
Salary/Pay: Starting base salary of $188,000 to $245,000 USD. Also includes equity, short- and long-term incentives, and a Total Rewards benefits package
Experience: Senior level, minimum of 10 years in technology, including 5+ years in information security and at least 3 years leading security teams. Experience leading security at a late-stage startup, scale-up, or public company.
Education: Bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent experience)
Skills Required:
- Security leadership: setting security strategy and roadmaps using a maturity model such as C2M2 or NIST CSF, and building and coaching a security team
- Compliance and audits: overseeing SOC 2 Type II, HITRUST, PCI DSS, HIPAA, and ISO 27001
- Data protection and privacy: healthcare data protection with HIPAA, GDPR, and CCPA/CPRA
- Technical security: application, network, and cloud security (AWS and Azure), with frameworks such as NIST CSF and OWASP
- Core security programs: incident response, risk management, vulnerability management, penetration testing, and security awareness
- Communication: executive-level communication and confidence engaging customers and sales teams on security requirements
- Budget management: allocating resources across people, tools, and vendors
- Certification: CISSP, CISM, or similar
Advantage: Experience leading security through an IPO, acquisition, or large-scale audit cycle; background in healthcare, digital health, or other highly regulated environments; experience in a remote-first, globally distributed company; familiarity with compliance automation platforms such as Drata; experience building a security engineering practice alongside platform and infrastructure teams
Date Posted: Oct 20, 2026
Application Deadline: Nov 19th, 2026
Description:
Carrot is hiring a Director, Information Security to lead the program that protects the sensitive fertility and family-building data of its members worldwide. You will set the security strategy, own both corporate and product security, and act as the trusted voice on Carrot's security posture with executives, auditors, and enterprise customers. The role builds on an already strong compliance foundation, with the goal of taking the program to the next level of maturity. Your work will include:
- Leading the security strategy and roadmap, and reporting progress to executive leadership
- Owning corporate security (GRC, incident management, security awareness, third-party risk) and product security (application, cloud, and infrastructure security, secure SDLC)
- Partnering with Engineering, especially the Internal Platform team, to build security into how systems are designed, shipped, and operated
- Leading internal risk assessments and turning the results into prioritized technical safeguards
- Owning the compliance portfolio (SOC 2 Type II, HITRUST, PCI DSS, HIPAA) and preparing for additional frameworks such as ISO 27001
- Directing incident response readiness, including playbooks and tabletop exercises
- Representing Carrot's security posture to employers, health plans, and health systems through security reviews and sales conversations
- Working with Legal and Privacy to meet global data protection requirements
- Building, coaching, and growing the security team, and managing the security budget, tooling, and vendors
How to Apply: Apply here.
Carrot as how