Chief Information Security Officer

Transform healthcare with us.

At Qualified Health, we're redefining what's possible with Generative AI in healthcare. Our infrastructure provides the guardrails for safe AI governance, healthcare-specific agent creation, and real-time algorithm monitoring, working alongside leading health systems to drive real change.

This is more than just a job. It's an opportunity to build the future of AI in healthcare, solve complex challenges, and make a lasting impact on patient care. If you're ambitious, innovative, and ready to move fast, we'd love to have you on board.

Job Summary

As Qualified Health scales its AI platform across leading health systems and pharmaceutical sponsors, security is fundamental to protecting sensitive data, earning customer trust, and deploying AI responsibly in healthcare. As our Chief Information Security Officer (CISO), you will own our enterprise security strategy, risk posture, and security and privacy program end to end.

You will partner with executive leadership, Engineering, Product, Legal, and Commercial to embed security and data privacy into our products, infrastructure, AI workflows, and business operations. You will lead our approach to security governance, healthcare compliance, incident response, and enterprise customer trust while building the capabilities needed to support our continued growth.

This is an executive leadership role that combines strategic ownership with technical depth. You can translate complex security risks into clear business decisions, work directly with engineering teams on critical technical challenges, and build a rigorous security program without creating unnecessary friction for the business.

Key Responsibilities

Security Strategy & Executive Leadership

• Own Qualified Health’s enterprise security strategy, risk posture, and roadmap, aligning priorities and investments with business objectives and the evolving threat landscape.

• Advise executive leadership on material risks, risk acceptance decisions, security investments, and the implications of new products and customer engagements.

• Establish security governance, policies, metrics, and accountability across the organization.

• Build out and scale the security organization, determining the right mix of internal expertise, external partners, and essential capabilities as the company grows.

Product, Cloud & AI Security

• Set technical security direction across application security, cloud infrastructure, identity and access management, vulnerability management, and secure software development.

• Partner with Engineering and Product to embed security into architecture, development, testing, deployment, and production operations.

• Establish safeguards for AI-enabled products and workflows, including protection of PHI across LLM integrations, AI agents, data pipelines, and connected systems.

• Work directly with engineering leaders to resolve high-impact technical risks while balancing security rigor with product velocity.

• Provide strategic direction and technical leadership in the design and implementation of a secure AI infrastructure, aligning architecture, governance, and risk controls with organizational security objectives and compliance requirements.

• Oversee DevOps and cloud infrastructure during our current growth phase, ensuring reliable, scalable, and secure platform operations.

Healthcare Compliance & Enterprise Trust

• Own the security program supporting HITRUST, SOC 2, and applicable customer and regulatory requirements, including control design, audit readiness, and ongoing effectiveness.

• Partner with Legal, Privacy, Engineering, and business leaders to translate contractual and regulatory obligations into practical controls.

• Serve as the senior security counterpart to health system and pharmaceutical customers, leading security diligence, technical assessments, and escalations.

• Partner with Commercial and Customer Success to resolve security-related deal blockers and build confidence in Qualified Health's security posture.

• Evaluate third-party and vendor risks, and determine when additional frameworks or certifications, such as HITRUST, are warranted.

Incident Response & Operational Resilience

• Own the security incident response program, including detection, escalation, investigation, containment, recovery, and post-incident remediation.

• Establish and test incident response, business continuity, and disaster recovery plans, coordinating with executive leadership, Legal, customers, and external specialists when needed.

• Support the Privacy Team in meeting HIPAA and state privacy law reporting obligations with robust risk assessments, incident response, and audit readiness processes.

• Build the operating model, tools, processes, and external partnerships needed to maintain effective security operations as the company scales.

• Drive security awareness and clear security ownership across Engineering, IT, and other business functions.…