Director, Information Security

Headquarters: Remote About Carrot: Carrot is the leading global fertility and family care platform, built on intelligent care orchestration: the right clinical guidance, at the right moment, in the context of each member’s life. More than a thousand multinational employers, health plans, and health systems trust Carrot to support millions of members across 195 countries – from pre-pregnancy through menopause and major life moments in between. Carrot's comprehensive clinical program delivers industry-leading cost savings for plan sponsors and award-winning experiences and improved outcomes for millions of people worldwide. Carrot is widely regarded as a defining force in healthcare innovation as a recipient of several top-tier awards, including Fast Company's 'Most Innovative Companies' and CNBC's '100 Barrier Breaking Startups'. The company is regularly cited by leading global outlets — including The Economist, Bloomberg, The Wall Street Journal, NPR, ABC News, and Harvard Business Review — as a leading voice on digital health, the future of work, and family health. Learn more at get-carrot.com . The Opportunity Carrot is looking for a Director, Information Security to lead the security program that protects the highly sensitive fertility and family-building data of members around the world. You will set the security strategy, own both corporate security (GRC, incident response, security awareness, vendor risk) and product security (application, cloud and infrastructure security, secure development lifecycle), and serve as the trusted voice on Carrot's security posture with executives, auditors, and enterprise customers. Day to day, you will balance setting direction with staying close to the work: prioritizing risk with Engineering and IT, guiding audit and certification cycles, coaching a small and talented team, and joining customer conversations where security is part of the buying decision. Carrot has already earned SOC 2 Type II, HIPAA, HITRUST, and PCI DSS compliance, so this role is about taking a strong foundation to the next level of maturity, not starting from scratch. What makes this role different is the combination of stakes and influence. Few security leaders get to protect data this personal, at global scale, while working directly with executive leadership and shaping how a health platform is built, sold, and trusted. What You’ll Own In this role, you will: Lead Carrot's security strategy and roadmap, using a recognized maturity model (such as C2M2 or NIST CSF) to prioritize investments and report progress to executive leadership Own the full security program across corporate security (GRC, incident management, security awareness, third-party risk) and product security (application security, cloud and infrastructure security, secure SDLC) Partner with Engineering, especially the Internal Platform team, to build security into how Carrot designs, ships, and operates its systems, going beyond compliance Lead internal risk assessments across application, cloud, and corporate environments and turn the results into prioritized technical safeguards Own the compliance portfolio, including SOC 2 Type II, HITRUST, PCI DSS, and HIPAA, and prepare Carrot for additional frameworks such as ISO 27001 as the business requires Direct incident response readiness, including playbooks, tabletop exercises, executive communication, and post-incident learning Represent Carrot's security posture to employers, health plans, and health systems through security reviews, questionnaires, and strategic sales conversations Work with Legal and Privacy to meet global data protection requirements (HIPAA, GDPR, CCPA/CPRA) for member health data Build, coach, and grow the security team, balancing hands-on execution with delegation as the team scales Manage the security budget, tooling, and vendor relationships, and tailor security guidance for a remote-first workforce and physical offices What Success Looks Like In your first 12–18 months, you w