Information Security Manager

We are looking for a qualified, hands-on Information Security Manager to design, implement, and operate the information security program for our growing healthcare organization operating under the PACE model.  This role blends strategic security leadership with practical execution. The ideal candidate can translate high regulatory and partner security standards into right-sized, pragmatic controls, while building sustainable governance, oversight, and audit processes. 

• Deploy HIPAA aligned best practice security architecture across our Microsoft 365 environment and Meraki based WAN 
  • Define, implement, and maintain administrative, technical, and physical security controls appropriate for a PACE organization
  • Own security design decisions and control selection, balancing risk, regulatory requirements, and operational realities 

• Security monitoring and incident response: configure and monitor tools, logs, and alerts, analyze activity, and investigate potential security incidents 
  • Serve as primary security escalation point for internal teams and external partners
  • Lead incident response planning, tabletop exercises, post-incident reviews, and remediation tracking 

• Perform vulnerability management activities, based on internal and external scans, and coordinate remediation activities 
  • Maintain an enterprise security risk register, including risk scoring, mitigation plans, and executive-level reporting 
  • Support business continuity and disaster recovery security requirements in partnership with IT and Operations 

• Lead Access and Identify management, developing best practice procedures, and enabling others to work within these processes 
  • Oversee privileged access, role-based access controls, joiner/mover/leaver processes, and periodic access reviews 
  • Ensure appropriate data protection controls for PHI, including encryption, logging, and monitoring 

• Draft, maintain, and enforce security policies, standards, and procedures aligned to HIPAA, NIST, and partner requirement 
  • Design and operate recurring security oversight and audit processes, including evidence collection and remediation tracking 
  • Lead and coordinate internal and external security audits, assessments, and partner security reviews 

• Establish and manage a third-party security and risk management program, including vendor risk assessments and ongoing monitoring 

• Partner closely with IT, Compliance, Legal, Clinical, and Operations teams to embed security into daily workflows

Qualifications:  

• Bachelor’s degree in Computer Science with an emphasis on Information Security, or equivalent experience.
• 7+ years of progressive experience in information security or cybersecurity roles, including hands-on implementation.
• 3–5 years of experience owning or leading security programs, controls, or governance functions including hands‑on experience in implementing information security best practices, and experience with security monitoring, incident response, or vulnerability management.
• Practical experience in a Health Care organization, and expertise in industry regulatory and standards frameworks (HIPAA, NIST, etc).
• Experience in cloud-based environments, specifically Microsoft 365.   
• Experience in networking concepts, operating systems, and cloud environments.
• Familiarity with regulatory and standards frameworks (HIPAA, NIST, etc.).
• Strong analytical and problem‑solving skills with attention to detail.
• Ability to lead through influence and communicate complex issues clearly to technical and non‑technical audiences.
• Must live in CA.
• Travel Requirement up to 2 weeks per quarter (to visit sites). 

Nice to haves  

• Experience in a start up organization.
• Experience supporting audits, partner security assessments, or SOC/HIPAA readiness efforts.
• Experience in creating technology solutions based on business requirements.
• Experience working remotely – this is a remote position.  
• Professional certifications such as CISSP, CISM, CISA, or Security+ (preferred).
• A strong connection to the mission of our business.
• Experience working with technology managed service providers. 

Compensation: 

The anticipated base salary range for this position is $133,000 - $157,000. This position is also eligible for a target annual bonus of 10% and may be eligible for additional incentive compensation, as applicable.

The final compensation offered will be determined based on factors including, but not limited to, the candidate's qualifications, skills, experience, education, certifications, geographical location, and business needs.

In addition, this position is eligible for a comprehensive benefits package, including medical, dental, and vision insurance; paid parental leave, short- and long-term disability coverage; life insurance; flexible spending accounts; a 401(k) savings plan that includes a match; paid time off; and company paid holidays.

 

At-Will Employment

Employment with Habitat Health is at-will. This means that either the employee or the employer may terminate the employment relationship at any time, with or without cause, and with or without notice, subject to applicable law. Nothing in this job posting or any other company document is intended to create a contract of employment, express or implied, or to alter the at-will nature of employment.

Any written or oral statements to the contrary are not authorized unless made in writing and signed by an authorized representative of the Company.

Because this is a remote position, employment will be governed by the laws applicable to the employee’s work location, and applicable legal requirements will be followed.