> Markdown version of [/jobs/ext/3683537-director-of-information-security-compliance](https://www.wearedevelopers.com/jobs/ext/3683537-director-of-information-security-compliance). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Director of Information Security & Compliance - **Company:** PELGA ENGINEERING, INC. - **Location:** New York, United States - **Salary:** $210,000.0 - $230,000.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Cloud Computing Security, Cyber Security, Continuous Integration, Disaster Recovery, Identity and Access Management, Systems Development Life Cycle, Software Vulnerability Management, Large Language Models, Software Security, AI Platforms - **Published:** October 11, 2026 - **Apply:** https://startup.jobs/director-information-security-compliance-pelago-10368474 ## About the Role * Experience leading information security and compliance in healthcare, health tech, or another regulated industry; strong working knowledge of HIPAA. * Cloud security expertise in a modern stack (AWS, infrastructure as code, containers, CI/CD). * Working knowledge across GRC, security operations, application security, and identity and access management. * Player-coach leadership experience: hands-on in the work while building a team. * Sound judgment about risk in a commercial context, including when to accept risk and when to escalate. * Ability to communicate clearly with engineers, clients, auditors, executives, and the Board Nice to haves: * Experience securing AI/LLM systems, agentic tools, or data used in model workflows. * Experience scaling a security program at a Series B or C company. * Certifications such as CISSP, CISM, CCSP, or HITRUST CCSFP. * Experience working with US health plans, PBMs, or large self-insured employers. ## Description * Outcome-driven: Engineers are given problems to solve, not just features to build. Success is measured by learning, impact, and outcomes-not velocity alone * AI-native: We use AI across the SDLC to accelerate implementation, testing, and review. Engineers focus on defining intent, validating behavior, and designing resilient systems * High autonomy, high accountability: Teams have real ownership over their domains. With autonomy comes responsibility for quality, safety, and results * Cross-functional by default: Engineers partner deeply with Product, Design, Data, and Clinical. Discovery, experimentation, and delivery are shared responsibilities * Quality and safety matter: We build in a regulated, member-impacting domain. Reliability, observability, and correctness are first-class concerns What You'll Do: Instead of task lists, anchor on ownership: * Own meaningful problem spaces end-to-end, from discovery through delivery and iteration * Design and evolve systems that support safe, scalable, AI-augmented development * Use data and experimentation to validate whether solutions actually work * Collaborate cross-functionally to balance member impact, clinical constraints, and technical tradeoffs * Shape how we work-our tools, processes, and culture What We Look For: We explicitly assess for empowerment: * You start with "why" before diving into "how" * You're energized by ambiguity and collaborative problem-shaping * You use AI to amplify your judgment and move faster on what matters * You think in systems and anticipate second-order effects * You want to own outcomes, not just ship features, Pelago's clients trust us with some of the most sensitive data a person has, and our SOC 2 Type II and HITRUST certifications are central to how we earn and keep that trust. We already hold both. The Director of Information Security & Compliance will keep that foundation strong as our business, data, and AI platform grow, setting Pelago's security strategy and leading the team that executes it. The hire we're looking for has owned accreditation outcomes in a regulated environment, is hands-on enough to do the work alongside a small team, and has the commercial judgment to make security something that accelerates deals rather than slowing engineering down., * Own SOC 2 Type II and HITRUST certification end to end, including audits, remediation, and recertification. * Develop and manage Pelago's security roadmap, budget, and tooling, and present key risks and recommendations to the executive team and Board. * Serve as the security lead in client security reviews, RFPs, questionnaires, and partner due diligence, partnering with Sales to position our security posture as a competitive advantage. * Maintain security policies and third-party vendor risk reviews, including reviews of new AI tools. * Automate evidence collection and implement continuous control monitoring so compliance scales with the business. * Own incident response, vulnerability management, and the penetration testing program. * Partner with Engineering on security monitoring, disaster recovery, secure design, and the security of our AI platform. * Partner with IT on identity and access management, and own the periodic access reviews our audits depend on. * Partner with Legal on the privacy program (HIPAA, GDPR, BAAs) and lead breach assessments. * Lead, coach, and grow the security team as a player-coach, building the case for and hiring the next people onto the team (1-2 direct reports today). * Set the bar for the function: clear ownership, sustainable on-call, career paths, and performance expectations. * Build security literacy across the company, from engineering to clinical, commercial, and operations teams.