Chief Information Security Officer (CISO) / Directeur de la sécurité de l'information

Please note that Insurity will only reach out to interview, make an offer of employment, or conduct onboarding activities for candidates who have applied through our careers site. When interviewing for a position, the candidate experience will include live interaction, such as a video or telephone call , with a Recruiter and/or company employee(s). We will never ask for any money or payments from applicants at any point in the recruitment process. Recruiters will only reach out from an insurity.com email address; no other email addresses will be used. Examples of fraudulent email addresses that have been used end with @insurityjobs.us. Be aware of suspicious recruitment activity. If you think you are a victim of an employment scam, you may contact your local law enforcement agency and/or visit the Federal Trade Commission website here: https://consumer.ftc.gov/articles/job-scams .

Who We Are

Insurity empowers insurance organizations to quickly capitalize on new opportunities by delivering the world’s most configurable, cloud-native, easy-to-use, and intuitively analytical insurance software. Just as importantly, we empower our people—providing the tools, support, and opportunities they need to grow and succeed.

We don’t just make bold promises—we deliver results. As the largest cloud-based software provider for the Property & Casualty market, Insurity is trusted by 22 of the top 25 P&C carriers and 7 of the top 10 wholesale brokers in the MGA space. Behind that trust is a team that delivers exceptional value and deep industry expertise.

While our technology sets us apart, it’s our people who truly make the difference. At Insurity, you’ll collaborate with some of the most creative and knowledgeable minds in insurance tech—in a culture that fosters innovation, teamwork, and continuous learning. Our award-winning onboarding experience welcomes and supports you from the moment you accept our offer.

Ready to grow your career with an industry leader? Apply today—we’re excited to welcome you. #UatInsurity

Insurity’s Next Chief Information Security Officer (CISO)

Insurity is seeking a strategic, operational, and technically credible Chief Information Security Officer to lead Insurity’s enterprise security, cybersecurity risk and privacy programs.

The CISO will protect Insurity’s information assets, products, customer environments, and technology ecosystem while enabling growth, cloud adoption, international expansion, and responsible use of artificial intelligence. This leader will translate cybersecurity, privacy, compliance, and technology risk into clear business decisions for executive leadership and the Board.

The successful candidate will combine executive presence with practical execution. They need to be comfortable setting strategy, leading through influence, engaging with customers executives and regulators, directing major incidents, reviewing architecture, and building the processes, team, and culture required for a growing SaaS company.

What Our Chief Information Security Officer (CISO) Will Do

Enterprise security strategy and governance

• Develop, implement, and continuously improve Insurity’s enterprise information security strategy, policies, standards, and control framework.
• Establish security priorities that align with business strategy, product roadmaps, customer commitments, and the organization’s risk appetite.
• Reinforce an enterprise security governance structure, including executive steering forums and appropriate reporting to the executive team and Board of Directors.
• Define clear accountability for security across Engineering, Product, Corporate IT, Cloud Operations, Legal, Privacy, and Compliance business functions.
• Provide risk-mitigating direction for initiatives with technology, data, cloud, product, or customer-security implications.
• Maintain a forward-looking view of emerging threats, technologies, regulations, and business risks.

HIPAA, PHI data protection

• Own and mature Insurity’s HIPAA compliance and electronic protected health information program where applicable to Insurity’s products, services, customers, vendors, and business operations.
• Lead documented HIPAA risk analyses, risk treatment plans, control testing, remediation tracking, and periodic program evaluations.
• Ensure appropriate administrative, physical, and technical safeguards for protected health information, including access control, authentication, audit controls, integrity, transmission security, encryption, contingency planning, and workforce security.
• Partner with Legal, Privacy, Compliance, Product, and Customer Success on the HIPAA Privacy, Security, and Breach Notification Rules.
• Establish requirements for Business Associate Agreements, customer obligations, subcontractors, cloud providers, and other third parties that create, receive, maintain, or transmit PHI.
• Maintain audit-ready evidence and support customer diligence, independent assessments, regulatory inquiries, and OCR requests.
• Lead the security component of PHI breach assessment, containment, investigation, notification coordination, and post-incident remediation.
• Ensure HIPAA-specific workforce training, sanctions, and awareness requirements are incorporated into the broader security program.

AI security, governance, and responsible adoption

• Establish and lead Insurity’s enterprise AI security and governance program.
• Maintain an inventory of AI, machine learning, large language model, generative AI, and agentic systems used, developed, procured, or embedded in Insurity products and operations.
• Define AI intake, risk classification, ownership, approval gates, prohibited uses, and human-oversight requirements.
• Establish secure-use standards for generative AI, including requirements for confidential information, PHI, PII, customer data, source code, proprietary data, prompts, outputs, retention, and model training.
• Define controls for AI-specific risks, including prompt injection, data leakage, insecure agents and tools, model abuse, data poisoning, supply-chain risk, unauthorized access, and unreliable or harmful outputs.
• Partner with Legal, Privacy, Product, Engineering, Data, and Compliance to address transparency, intellectual property & data rights of emerging AI regulations.
• Incorporate AI security and governance requirements into procurement, third-party risk management, secure development, cloud architecture, product reviews, and customer commitments.

Risk management, compliance, and assurance

• Develop a risk-based process for identifying, assessing, prioritizing, treating, and accepting information security and technology risks across Insurity’s ecosystem.
• Maintain alignment with applicable requirements and leading practices, including HIPAA, SOC 2, ISO/IEC 27001, GDPR & the NIST Cybersecurity Framework.
• Orchestrate internal and external audits through planning, evidence collection, testing, findings management, remediation, and executive reporting.
• Establish control ownership, evidence standards, issue-management processes, and sustainable remediation tracking.
• Advise management on the costs, value, and risks of security and technology investments.
• Support cyber-insurance requirements, underwriting reviews, claims preparation, and risk-improvement initiatives.
• Monitor regulatory and contractual changes and translate them into practical requirements, policies, and implementation plans.
• Report material risks, exceptions, incidents, and remediation plans to executive leadership and the Board.

Security operations and incident response

• Lead the enterprise security operations program, including monitoring, threat intelligence, vulnerability management, detection and response, penetration testing, and security investigations.
• Manage security incident response coordinating both internally and externally from inception to resolution.
• Maintain an incident response program that covers cyber incidents, privacy events, PHI incidents, ransomware, cloud compromise, insider threats, supply-chain events, and AI-related incidents.
• Lead security incident response partnering with Insurity’s COO and CLO while remaining sufficiently engaged in technical and operational details.
• Establish escalation criteria, severity definitions, communications protocols, evidence-preservation practices, and post-incident review requirements.
• Coordinate with Legal, Privacy, Compliance, Communications, customers, insurers, law enforcement, and regulators as appropriate.
• Measure response effectiveness through exercises, lessons learned, time-to-detect, time-to-contain, time-to-recover, and remediation completion.
• Lead regular cyber crisis tabletop exercises and simulations with executive leadership, key operational teams, customers, and external partners where appropriate.
• Maintain crisis communications and breach-disclosure playbooks in partnership with Legal, Communications, Privacy, and executive leadership.
• Ensure lessons from incidents and exercises are converted into funded improvements.

Product, application, cloud, and infrastructure security

• Embed security-by-design into product development, architecture, engineering, DevOps, and change-management processes.
• Establish and oversee application security practices, including secure coding, threat modeling, SAST, DAST, software composition analysis, penetration testing, vulnerability disclosure, and release gates.
• Lead software supply-chain security, including dependency governance, SBOMs, artifact integrity, code-signing expectations, CI/CD controls, and third-party component risk.
• Oversee cloud-security architecture, identity and access management, encryption, secrets management, network segmentation, logging, monitoring, data-loss prevention, and secure configuration management.
• Promote Zero Trust principles, least privilege, strong authentication, secure-by-default configurations, and continuous control monitoring.
• Review and approve security architecture for major products, platforms, infrastructure changes, AI systems, and customer-facing capabilities.

Third-party risk, customer trust, and commercial enablement

• Establish a risk-based third-party security and privacy program covering vendors, cloud providers, subprocessors, partners, supply-chain participants, and other external parties.
• Ensure contracts, security requirements, audit rights, breach obligations, data-use restrictions, and Business Associate obligations are addressed with Legal and Procurement.
• Establish and maintain data classification, data inventory, data-flow, retention, deletion, residency, and access-governance practices.
• Ensure security requirements are addressed across the lifecycle of customer, employee, regulated, confidential, and proprietary information.

Leadership, organization, and culture

• Build and lead a cost-efficient, high-performing security organization with appropriate direct and dotted-line relationships across Engineering, Product, IT, Cloud Operations, Privacy, Compliance, and other functions.
• Hire, develop, coach, and retain security talent while establishing clear operating rhythms and accountability.
• Create and manage security awareness and role-based training for employees, contractors, approved system users, developers, administrators, and executives.
• Promote a culture in which security is viewed as an enabler of customer trust, product quality, resilience, and business growth.
• Manage the security budget, partner strategy, managed service providers, and external security resources.
• Define and report meaningful security metrics, risk indicators, maturity measures, control health, remediation progress, incident trends, audit results, customer commitments, and AI-governance metrics.

Who We’re Looking For

• A strategic leader and builder who can establish vision, create alignment, and execute through influence.

• A credible executive communicator who can brief the Board, lead a crisis, engage customers, and explain complex issues in simple terms.

• A pragmatic security leader who balances risk reduction, business enablement, customer commitments, speed, and cost.

• A collaborative partner to Engineering, Product, IT, Legal, Privacy, Compliance, Finance, Sales, Customer Success, and executive leadership.

• A calm, decisive leader who can operate effectively in high-pressure, high-stakes situations.

• A leader who is comfortable working hands-on when necessary while building a scalable team and operating model.

Required qualifications and experience

• Bachelor’s degree in information security, computer science, information technology, business, or a related field; equivalent experience may be considered.

• 8–10 years of progressive experience in information security, cybersecurity, technology risk, or related disciplines within a SaaS, cloud, technology, insurance, healthcare, or other regulated environment.

• At least 5 years of executive or senior leadership experience in a CISO, Deputy CISO, Head of Security, or comparable role.

• Demonstrated experience building and operating an enterprise security program across a distributed or remote organization.

• Experience with HIPAA, ePHI, Business Associate requirements, healthcare data protection, or comparable regulated-data obligations.

• Demonstrated experience leading security risk assessments, audits, remediation programs, and regulatory or customer assurance activities.

• Experience leading material incidents, crisis response, business continuity, disaster recovery, and executive communications.

• Experience establishing or operating an AI security, AI governance, responsible AI, model-risk, or secure-generative-AI program.

• Strong understanding of cloud, SaaS operating models, identity, encryption, application security, vulnerability management, incident response, and third-party risk.

• Exceptional written, verbal, presentation, negotiation, and stakeholder-influencing skills.

• Demonstrated ability to manage budgets, partners, vendors, priorities, and complex cross-functional programs.

Preferred qualifications

• CISSP, CISM, CISA, CRISC, CCSP, or equivalent certification.

• Experience with SOC 2 Type II, ISO/IEC 27001, NIST CSF, NIST AI RMF, or comparable frameworks.

• Experience with AI/ML security, LLM security, agent security, model risk management, AI impact assessments, or AI red teaming.

• Experience supporting customer security reviews, RFPs, renewals, and executive-level trust discussions.

• Experience in insurance technology, property and casualty insurance, healthcare technology, or another data-intensive regulated industry.

• Experience with cyber-risk quantification, cyber insurance, secure software supply chains, DevSecOps, and cloud-native security.

What’s In It For U

Work Where You Thrive Find the work environment that supports your best—whether that’s remote, in-office, or hybrid—depending on your role and location. Our Flex First Workforce approach offers many fully remote opportunities, while some teams follow hybrid or in-office schedules to stay connected and collaborative.

Take Time When You Need It We trust our team to manage their time with our Open PTO Policy, empowering you to recharge when it matters most.

Benefits That Start on Day One Enjoy comprehensive health coverage and employer-matched retirement savings right from your first day—because we know how important these are to you.

Living Our Values Every Day Our core values are more than words on a wall—they guide how we hire, grow, and retain the very best talent.

Award-Winning Onboarding From your first day to your first anniversary, our onboarding program is designed to set you up for success and help you make an immediate impact.

Grow Your Career from Within We believe in promoting from within. In fact, over 25% of our open roles are filled by internal candidates.

Mentorship That Matters Our mentorship program connects you with experienced leaders who are committed to helping you grow both personally and professionally.

Insurity Podcasts Explore podcasts from our Learning & Development team for deeper insight into Insurity products, company innovation, and the business as a whole.

Keep Learning, Always Fuel your growth with full access to LinkedIn Learning and Kaplan—because continuous development is key to success.

Invest in Your Future—And Your Family’s Through our partnership with the University of Arizona Global Campus, you and your family can access discounted tuition and pursue educational goals affordably.

Earn When You Refer Love where you work? Invite others to join us! Our Employee Referral Bonus program rewards you for bringing great people on board.

We have five Core Values at Insurity; one of which is to Act with Integrity . Providing pay transparency helps you make the best decision for you. We continuously analyze and update our salary ranges for our roles according to market trends to not only ensure our employees are paid fairly, but also help close gender, race, and disability wage gaps. Along with the benefits listed above, the career level salary range for this role is $216,000 to $325,000 . We share a career level salary as a guideline; however, actual salary may vary based on your experience and qualifications. If your application advances, your recruiter will review these details with you during a video interview.

Languages for Québec candidates: The knowledge of French is required for positions permanently located in Quebec. The English language is required for this position in order to communicate with clients, partners, and colleagues, who are strictly located outside of Québec. French-language training will be offered to candidates who do not have a good knowledge of French.

Insurity is proud to be an Equal Opportunity Employer

We are dedicated to creating an exceptional work environment for all our employees by extending a culture of diversity, equity, inclusion, and belonging into the very fabric of our organization. We embrace differences and diversity of identity, experience, and thought, and actively strive for inclusive behaviors across our company.

We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application and/or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.

Thank you for your interest in Insurity! Please understand that due to the volume of applicants we receive, only selected candidates will be contacted.

#LI-Remote

medical insurance; dental insurance; vision insurance; 401(K) match; paid maternity leave; paid paternity leave; disability insurance

Veuillez noter qu'Insurity ne contactera que les candidats qui ont postulé via notre site Carrières pour les convoquer à un entretien, leur faire une offre d'emploi ou mener des activités d'intégration. Lors des entretiens pour un poste, l'expérience du candidat comprendra une interaction en direct, par exemple une vidéo ou un appel téléphonique, avec un recruteur et/ou un ou plusieurs employés de l'entreprise. Nous ne demanderons jamais d'argent ou de paiement aux candidats à aucun moment du processus de recrutement. Les recruteurs vous contacteront uniquement à partir d'une adresse e-mail insurity.com ; aucune autre adresse e-mail ne sera utilisée. Les adresses e-mail frauduleuses utilisées se terminent par @insurityjobs.us. Méfiez-vous des activités de recrutement suspectes. Si vous pensez être victime d'une arnaque à l'emploi, vous pouvez contacter les forces de l'ordre locales et/ou consulter le site web de la Commission fédérale du commerce à l'adresse suivante : https://consumer.ftc.gov/articles/job-scams .

Qui sommes-nous ?

Insurity permet aux organismes d'assurance de saisir rapidement de nouvelles opportunités en proposant le logiciel d'assurance le plus config