SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 210,000 - 230,000 / annual
Pelago Health is a specialty substance use care provider that matches treatment intensity to individual member needs. The company has scaled to serve hundreds of employers and health plans, helping over 750,000 members manage substance use. Pelago recently launched Sona, a voice-first AI Mental Health Specialist, combining clinical expertise with technology to expand access to mental health care.
As Director of Information Security & Compliance, you will own Pelago's security and compliance strategy as the business, data, and AI platform scale. You will lead a small team (currently 1–2 direct reports) and serve as the primary security leader across the organization.
Key responsibilities include:
- Own SOC 2 Type II and HITRUST certification end-to-end, including audits, remediation, and recertification
- Develop and manage Pelago's security roadmap, budget, and tooling; present key risks and recommendations to executives and the Board
- Lead client security reviews, RFPs, questionnaires, and partner due diligence, positioning security as a competitive advantage
- Maintain security policies and conduct third-party vendor risk reviews, including new AI tools
- Automate evidence collection and implement continuous control monitoring to scale compliance with business growth
- Own incident response, vulnerability management, and penetration testing programs
- Partner with Engineering on security monitoring, disaster recovery, secure design, and AI platform security
- Partner with IT on identity and access management and periodic access reviews
- Partner with Legal on privacy programs (HIPAA, GDPR, BAAs) and lead breach assessments
- Lead, coach, and grow the security team as a player-coach; build the case for and hire additional team members
- Set performance expectations, career paths, and sustainable on-call practices
- Build security literacy across engineering, clinical, commercial, and operations teams
This is a hybrid role requiring 3 days per week in the NYC office.
Requirements:
- Direct accountability for SOC 2 Type II and HITRUST outcomes
- Experience leading information security and compliance in healthcare, health tech, or another regulated industry; strong working knowledge of HIPAA
- Cloud security expertise in a modern stack (AWS, infrastructure as code, containers, CI/CD)
- Working knowledge across GRC, security operations, application security, and identity and access management
- Player-coach leadership experience: hands-on in the work while building a team
- Sound judgment about risk in a commercial context, including when to accept risk and when to escalate
- Ability to communicate clearly with engineers, clients, auditors, executives, and the Board
Nice to haves:
- Experience securing AI/LLM systems, agentic tools, or data used in model workflows
- Experience scaling a security program at a Series B or C company
- Certifications such as CISSP, CISM, CCSP, or HITRUST CCSFP
- Experience working with US health plans, PBMs, or large self-insured employers
