SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 188,000 - 245,000 / annual
Carrot Fertility is seeking a Director of Information Security to lead the security program protecting sensitive fertility and family-building data for millions of members across 195 countries. This is a strategic leadership role combining corporate security (GRC, incident response, security awareness, vendor risk management) and product security (application, cloud, infrastructure security, secure development lifecycle).
You will set Carrot's security strategy and roadmap using recognized maturity models (C2M2, NIST CSF), own the full security program across corporate and product domains, and serve as the trusted voice on security posture with executives, auditors, and enterprise customers. Day-to-day responsibilities include balancing strategic direction with hands-on execution: prioritizing risk with Engineering, guiding audit and certification cycles, coaching a talented security team, and participating in customer conversations where security influences buying decisions.
Carrot has already achieved SOC 2 Type II, HIPAA, HITRUST, and PCI DSS compliance; this role focuses on advancing maturity from a strong foundation. Key responsibilities include leading internal risk assessments, owning the compliance portfolio, directing incident response readiness, representing security posture to employers and health plans, coordinating with Legal and Privacy on global data protection (HIPAA, GDPR, CCPA/CPRA), building and coaching the security team, and managing security budget and vendor relationships.
Success in the first 12–18 months means: a documented, executive-endorsed security strategy with clear priorities; clean audit outcomes with timely remediation; a tested incident response program with regular tabletop exercises; measurable reduction in high-risk vulnerabilities; a living risk register and vendor review process; a security team with defined roles and growth paths; faster, more consistent security reviews for Sales and Customer Success; and visible progress on additional frameworks such as ISO 27001.
Carrot is a mission-driven, high-growth healthtech company recognized by Fast Company, CNBC, and others as a defining force in healthcare innovation. The role offers the opportunity to protect deeply personal data at global scale while shaping how a health platform is built, sold, and trusted.
REQUIREMENTS:
- Bachelor's degree in Computer Science, Information Technology, or related field (or equivalent experience)
- 10+ years in technology, including 5+ years in information security and at least 3 years leading security teams
- Security certification such as CISSP or CISM
- Experience leading the security function at a late-stage startup, scale-up, or public company
- Working depth in healthcare data protection and privacy frameworks (HIPAA, GDPR, CCPA/CPRA)
- Experience overseeing enterprise frameworks and audits (SOC 2 Type II, HITRUST, PCI DSS, ISO 27001)
- Strong knowledge of application, network, and cloud security (AWS, Azure) and frameworks (NIST CSF, OWASP)
- Experience running core security programs (incident response, risk management, vulnerability management, penetration testing, security awareness)
- Executive-level communication skills and confidence engaging customers and sales teams
- Experience managing budget and allocating resources across people, tools, and vendors
NICE TO HAVE:
- Experience leading security through major company events (IPO, acquisition, large-scale audit cycle)
- Background in healthcare, digital health, or other highly regulated, high-trust environments
- Experience leading security in remote-first, globally distributed companies
- Familiarity with compliance automation platforms such as Drata
- Experience building a security engineering practice alongside platform and infrastructure teams
