Head of Corporate and Information Security
About this role
Protecting sensitive protected health information and enterprise customer data is the primary challenge for this foundational hire at Layer Health. As the first Head of Corporate and Information Security, this individual will scale the security and compliance function while reporting directly to leadership. The person in this role will own the security strategy, risk program, technical security posture across GCP environments, and corporate security systems.
Day-to-day responsibilities involve partnering closely with engineering and infrastructure teams to strengthen cloud IAM, network security, and code security, while also establishing a roadmap toward ISO 27001 certification. Ideal candidates bring a builder's mindset and deep experience in information security within fast-moving startup environments. Someone who thrives on uncertainty, balances rigorous risk management with business needs, and possesses hands-on technical fluency will excel here.
What you will do
- Own the company security strategy and risk program across product, cloud infrastructure, corporate systems, endpoints, vendors, and operational processes.
- Partner with engineering and infrastructure teams to enhance technical security across GCP environments and the software development lifecycle.
- Define and improve controls to protect PHI, customer data, and credentials throughout their lifecycle.
- Build out detection, incident response, and security operations capabilities including centralized telemetry and SIEM integration.
- Refine corporate security across employee identity, endpoints, SaaS applications, and device management in collaboration with operations and IT.
- Strengthen human security through comprehensive awareness training, phishing simulations, and social engineering exercises.
What you need
- Bring at least seven years of experience in information security, security engineering, or related roles with ownership across multiple security domains.
- Demonstrate experience building or materially evolving a security program within a startup or growth-stage technology company.
- Possess strong technical depth in modern cloud environments with hands-on GCP experience strongly preferred.
- Understand security operations and incident response principles, including the ability to build telemetry, detection, and investigation capabilities.
- Have experience protecting sensitive data in regulated environments with a preference for healthcare and HIPAA compliance.
- Show familiarity with security and compliance frameworks such as SOC 2 and ISO 27001.
- Exhibit strong risk judgment and clear communication skills to articulate technical issues to engineers and business decisions to executives.
Nice to have
- Experience leading an organization through ISO 27001 certification
- Experience protecting PHI and navigating HIPAA requirements
Skills and tech stack
Questions candidates ask
What is the expected compensation for this role?
The expected compensation range for this role is $180,000 to $230,000. Compensation is dependent on experience and overall fit to the role.
Who will I report to?
You will report directly into leadership and have the mandate to continue to build the security program the right way.
What kind of company background is Layer Health coming from?
Layer Health was founded in 2023 by leading machine learning researchers from MIT and Harvard Medical School. The diverse founding team brings expertise across machine learning, UI/UX, large language models, and medicine.