Want to know if this job is worth applying to?
Remote
Remote only
About Stellar Health:
Historically, US Healthcare has relied on a fee-for-service reimbursement system where providers are paid based on the quantity of patient visits and procedures, rather than the quality of health outcomes.
At Stellar Health, we help primary care providers put patient health first. Our platform - a mix of technology, people, and analytics - supports providers at the point of care, delivering real-time patient information, activating practice staff, and empowering providers and care teams with incentives that reward the work they are already doing to keep patients healthy. Using the Stellar App, our web-based, point-of-care tool; practices receive a simple checklist of recommended actions that support the best quality care. Providers and care teams are then paid monthly for each action they complete, and Payors save money in reduced healthcare costs along the way.
Stellar is a US-based Health-tech backed by Top VCs (General Atlantic, Point72, & Primary Venture Partners) with an established product & proven operating model. We’ve shown that we make a real difference for physician practices and their patients.
About the Position
Stellar Health is seeking a Vice President, Information Security to lead and evolve the company’s security program. As VP, you will own the full scope of information security strategy, operations, governance, and budget. You will report to Stellar’s Chief Compliance Officer (CCO) and partner closely with Stellar’s Chief Technology Officer and cross-functional leaders across Engineering, Product, Operations, Legal, and People. You will lead and manage a small team, with the opportunity to grow in line with business needs.
Security sits within Stellar’s Compliance team, which is relatively mature, and a threat-based risk framework is already in place. Your mandate is to scale the security function and redesign its operating model where growth demands it. Specifically, you will take what exists and elevate it by driving security governance in partnership with the CCO, defining a multi-year security roadmap tied to Stellar’s growth milestones, navigating the security implications of Stellar’s expanding AI capabilities, and maintaining and growing the trust of our health plan customers, provider networks, and the patients they serve.
You will operate at the intersection of healthcare regulation, enterprise information security, and product innovation. Our customers range from mid-market health plans to large national enterprises and government payors, each with their own security requirements. You will serve as Stellar’s executive security counterpart to customer CISOs and security leadership, owning those relationships and building the trust that underpins Stellar’s commercial growth. The right candidate will present a risk posture to a health plan’s board one day and work through a threat model with an engineering team the next.
What You’ll Do
Own Stellar’s enterprise security strategy, aligning it with business objectives, regulatory obligations, and customer expectations
Serve as the senior security voice, providing regular reporting to the CCO and executive leadership on AI and traditional risk postures, program maturity, investment priorities, and emerging threats. Provide the security expertise behind the CCO’s reporting to the Board
Lead the continued evolution of Stellar’s threat-based risk model
Own the security budget and resource allocation, ensuring investments are prioritized against Stellar’s threat landscape and aligned with the company’s multi-year growth plan. Build and defend the investment case to executive leadership, tying spend to risk reduction and to the revenue that security enables
Set the security standards Stellar must meet across cloud security, application security, endpoint protection, and identity and access management, and be accountable for meeting them. Stay hands-on given the size of the team, including security architecture reviews, risk assessments, incident response, and customer security reviews
Own Stellar’s third-party and cyber risk management. This includes setting the security standard for vendors with access to PHI, with authority to approve, condition, or block them, and managing Stellar’s cyber insurance program in coordination with Finance and Legal
Own Stellar’s incident response and business continuity readiness, including regular testing, and lead the security response when an incident occurs
Lead security due diligence for strategic partnerships, new payor relationships, and potential acquisitions, ensuring security risk is evaluated as part of corporate development and growth decisions
Serve as Stellar’s security counterpart in customer relationships, leading security reviews, responding to enterprise due diligence requests, and representing Stellar’s security posture to health plan CISOs and procurement teams
Ensure Stellar’s security program satisfies the requirements of federal and state security and privacy laws
Lead security-side preparation for HITRUST audits and manage remediation of findings; maintain readiness for customer-driven security assessments and due diligence
Stay ahead of evolving regulatory requirements, including AI governance frameworks and state-level health data privacy laws. Bring threat and industry perspective to executive leadership, including when the message is unwelcome
Develop Stellar’s position on responsible AI security practices in a way that enables innovation while honoring upstream contractual restrictions on data use and processing. Partner with Engineering and Product to establish and enforce security guardrails for Stellar’s AI initiatives
Set and enforce the security standard for AI tools adopted across the organization, with authority to approve or restrict tools that don’t meet Stellar’s PHI handling and data classification standards or its contractual and legal commitments
Design the security function’s operating model and organizational structure to support Stellar’s growth. Hire, develop, and lead a team with depth in cloud security, application security, and healthcare-specific compliance
Build a security-aware culture across the organization through training and embedded partnerships with Engineering and Product teams. Set the standard for how Stellar builds and operates securely
Define what success looks like for the security function and report measurable progress against it
As Vice President, Information Security, You Should Have
13+ years of progressive experience in information security, with at least 5 years in a senior leadership role (Senior Director or above) owning security strategy and/or operations in a software product organization
Deep expertise in healthcare or health-tech security, with hands-on experience navigating HIPAA, HITRUST, and the regulatory dynamics unique to companies that handle PHI and payor data
Demonstrated experience with threat-based or risk-based security frameworks, with a philosophy grounded in risk mitigation rather than risk elimination
Proven people-management experience hiring, developing, and leading a small, high-performing security team in a high-growth software product environment, and scaling it in line with business needs
Strong executive presence with a track record of influencing peers, presenting to boards of directors, and speaking with existing and potential customers
Experience managing security in SaaS-first, cloud-native environments (AWS preferred)
Demonstrated ability to personally adopt AI tools and lead AI adoption across a team, with measurable productivity gains and a mindset toward leveraging emerging technology to scale security operations
Depth in AI/ML security, including data governance, model security, and third-party AI risk assessment
Strong problem-solving skills and the credibility to disagree with senior executives, hold the line on risk, and still reach alignment
Ability to lead through influence and manage key senior stakeholders across Engineering, Product, Finance, Legal, People, and Compliance
Experience owning a security budget and making resource allocation decisions that balance risk reduction with business investment
Demonstrated ability to lead security due diligence for M&A, strategic partnerships, and new business line launches. Experience recommending remediation paths and explaining the business impact of risks discovered
Bonus Points
CISSP, CISM, or similar certifications
HITRUST Certified CSF Practitioner (CCSFP)
HITRUST audit management experience
Experience with CMS data handling requirements and government payor security expectations
Perks & Benefits:
Stellar offers a carefully curated selection of wellness benefits and perks to our employees:
Medical, Dental and Vision Benefits
Flexible PTO
Universal Paid Family and Caregiver Leave
Wellhub+ Gym Memberships
Pre-tax commuter benefits, HA, FSA plans
Company sponsored One Medical memberships and Citibike memberships
Medical Travel Benefits
JOON, a flexible lifestyle spending account that gives our team a monthly stipend to spend on what matters most to them
Stock Options & a 401k matching program
A broad calendar of company sponsored social events that for our in-office and remote employees
Company sponsored lunch for all NY HQ employees
Diversity is the key to our success. Stellar Health is an equal opportunity employer and we are open to all qualified applicants regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or expression, veteran status, or any other legally protected status.
We believe that diverse teams -and the different identities, cultures, and life experiences our team members bring to the table- enable us to create amazing products, find creative solutions to interesting problems, and build an inclusive working environment.
Stellar Health Employment Privacy Notice
At Stellar Health, your privacy and security as a job seeker is a priority no matter where you are in the interview process. As recruiting scams have become more prevalent, please take note of the following practices to ensure the legitimacy of any interaction with our team.
Please note that any communication from our recruiters and hiring managers at Stellar Health about a job opportunity will only be made by a Stellar Health employee with an @stellar.health email address.
Stellar Health does not utilize third-party agencies for recruitment services and does not conduct text message or chat-based interviews. Any other email addresses, agencies, or forums may be phishing scams designed to obtain your personal information.
We will not ask you to provide personal or financial information, including, but not limited to, your social security number, online account passwords, credit card numbers, passport information, and other related banking information until we begin onboarding activities, which will be coordinated by a member of the Stellar Health People Ops Team with an @stellar.health email address.
If you are ever unsure whether you are in contact with a legitimate Stellar Health teammate, please contact people-team@stellar.health. If you believe you've been a victim of a phishing attack, please mark the communication as “spam” and immediately report it by contacting the U.S. Federal Trade Commission.