Director, Information Security - Carrot
Headquarters: Remote
Source: We Work Remotely
About Carrot
Carrot is the leading global fertility and family care platform, built on intelligent care orchestration: the right clinical guidance, at the right moment, in the context of each member’s life. More than a thousand multinational employers, health plans, and health systems trust Carrot to support millions of members across 195 countries – from pre-pregnancy through menopause and major life moments in between.
Carrot is widely regarded as a defining force in healthcare innovation as a recipient of several top-tier awards, including Fast Company's 'Most Innovative Companies' and CNBC's '100 Barrier Breaking Startups'. Learn more at get-carrot.com.
The Opportunity
Carrot is looking for a Director, Information Security to lead the security program that protects the highly sensitive fertility and family-building data of members around the world. You will set the security strategy, own both corporate security (GRC, incident response, security awareness, vendor risk) and product security (application, cloud and infrastructure security, secure development lifecycle), and serve as the trusted voice on Carrot's security posture with executives, auditors, and enterprise customers.
Day to day, you will balance setting direction with staying close to the work: prioritizing risk with Engineering and IT, guiding audit and certification cycles, coaching a small and talented team, and joining customer conversations where security is part of the buying decision. Carrot has already earned SOC 2 Type II, HIPAA, HITRUST, and PCI DSS compliance, so this role is about taking a strong foundation to the next level of maturity.
What You’ll Own
- Lead Carrot's security strategy and roadmap, using a recognized maturity model (such as C2M2 or NIST CSF) to prioritize investments and report progress to executive leadership.
- Own the full security program across corporate security (GRC, incident management, security awareness, third-party risk) and product security (application security, cloud and infrastructure security, secure SDLC).
- Partner with Engineering, especially the Internal Platform team, to build security into how Carrot designs, ships, and operates its systems.
- Lead internal risk assessments across application, cloud, and corporate environments and turn the results into prioritized technical safeguards.
- Own the compliance portfolio, including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA, and prepare Carrot for additional frameworks such as ISO 27001.
- Direct incident response readiness, including playbooks, tabletop exercises, executive communication, and post-incident learning.
- Represent Carrot's security posture to employers, health plans, and health systems through security reviews, questionnaires, and strategic sales conversations.
- Work with Legal and Privacy to meet global data protection requirements (HIPAA, GDPR, CCPA/CPRA) for member health data.
- Build, coach, and grow the security team, balancing hands-on execution with delegation as the team scales.
- Manage the security budget, tooling, and vendor relationships, and tailor security guidance for a remote-first workforce and physical offices.
What Success Looks Like
In your first 12–18 months, you will have:
- A documented, executive-endorsed security strategy and multi-year roadmap.
- Clean outcomes on recurring audits and certifications (SOC 2 Type II, HITRUST, PCI DSS).
- A tested incident response program with regular tabletop exercises.
- A measurable reduction in high-risk vulnerabilities and open security findings.
- A living risk register and vendor security review process.
- A security team with defined roles and clear growth paths.
- Faster, more consistent security reviews for Sales and Customer Success.
- A clear plan and visible progress on additional frameworks (e.g., ISO 27001).
About You
- Bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent experience).
- 10+ years of experience in technology, including 5+ years in information security and at least 3 years leading security teams.
- A security certification such as CISSP or CISM.
- Experience leading the security function at a late-stage startup, scale-up, or public company.
- Working depth in healthcare data protection and privacy frameworks (HIPAA, GDPR, CCPA/CPRA).
- Experience overseeing enterprise frameworks and audits (SOC 2 Type II, HITRUST, PCI DSS, ISO 27001).
- Strong knowledge of application, network, and cloud security (AWS and Azure) and frameworks such as NIST CSF and OWASP.
- Experience running core security programs (incident response, risk management, vulnerability management, penetration testing, security awareness).
- Executive-level communication skills and confidence engaging customers and sales teams.
- Experience managing budget and allocating resources across people, tools, and vendors.
Nice to Have ⭐
- Experience leading security through a major company event such as an IPO, acquisition, or large-scale audit cycle.
- A background in healthcare, digital health, or another highly regulated, high-trust environment.
- Experience leading security in a remote-first, globally distributed company.
- Familiarity with compliance automation platforms such as Drata.
- Experience building a security engineering practice alongside platform and infrastructure teams.
Why Candidates Join Carrot
- A mission-driven company focused on expanding access to fertility and family-forming care globally.
- A high-growth environment where leaders are empowered to shape strategy and drive impact.
- Competitive compensation, equity, and comprehensive benefits.
- Flexible Time Off and a culture that actively encourages employees to recharge.
- Comprehensive parental leave and family-forming benefits.
- A collaborative, inclusive, and values-driven culture.
Compensation
The starting base salary for this position will range from $188,000.00 - $245,000.00. Actual compensation may vary from posted base salary depending on your confirmed job-related skills and experience.
Fraud and Security Notice
Please note that all communication regarding job opportunities at Carrot will come exclusively from an @get-carrot.com email address. If you receive messages from any other domain, please disregard them and report the incident to: securityreporting@get-carrot.com.
A Note on AI
At Carrot, we believe AI can help us work smarter, move faster, and create more meaningful experiences. We look for people who embrace new ways of working, use AI responsibly to improve quality and efficiency, and continue to learn as the technology evolves.