Chief Information Security Officer

Information Security Strategy & Leadership

• Develop, implement, and continuously evolve Matter Health's enterprise information security strategy, ensuring alignment with organizational goals, clinical operations, and regulatory requirements.
• Establish and maintain security policies, standards, and procedures covering data protection, access controls, acceptable use, and third-party risk management.
• Build and mature security governance frameworks, including NIST CSF and HITRUST CSF, appropriate for an organization handling protected health information (PHI).
• Lead security budget planning, vendor selection, and technology investments while balancing security needs with organizational priorities.
• Manage and develop internal cybersecurity resources while collaborating with external security partners and consultants.
• Provide regular security updates, risk assessments, and strategic recommendations to executive leadership, including occasional presentations to the Board of Directors.

Cybersecurity Operations & Risk Management

• Oversee threat detection, intrusion prevention, security monitoring, and Security Information and Event Management (SIEM) and Security Operations Center (SOC) operations.
• Lead cybersecurity incident response, including incident investigation, containment, remediation, and recovery.
• Develop and maintain incident response plans, coordinate tabletop exercises, and oversee organizational preparedness for potential security incidents.
• Direct vulnerability management, penetration testing, and remediation programs across infrastructure, applications, and third-party integrations.
• Oversee identity and access management (IAM), including privileged access management, role-based controls, and least-privilege principles.
• Partner with Technology to maintain secure cloud infrastructure, encryption, and data protection practices.
• Oversee endpoint and mobile device security for clinical and field-based employees working in patients' homes.
• Partner with Technology and Clinical Operations on business continuity and disaster recovery planning to support operational resilience.

Healthcare Security, Compliance & Governance

• Ensure compliance with the HIPAA Security Rule, HITECH, and applicable federal and state healthcare security requirements.
• Partner with Compliance on patient privacy, regulatory reporting, breach notification obligations, and related requirements.
• Support organizational HITRUST certification initiatives, including security control implementation, readiness activities, remediation, and ongoing compliance.
• Maintain security readiness for regulatory audits, payer security assessments, and third-party evaluations.
• Oversee vendor and third-party security risk management, including security reviews of business associates and partners handling protected health information.
• Serve as a primary security contact for payer questionnaires, security attestations, audits, and due diligence requests.
• Maintain working knowledge of Medicare, Medicaid, Medicare Advantage, CMS guidance, and payer-specific security expectations.

Collaboration & Security Culture

• Partner with Technology, Engineering, Compliance, Legal, and Clinical Operations to integrate security into business processes and technology initiatives.
• Develop and oversee organization-wide security awareness and training programs.
• Promote a culture of security accountability, risk awareness, and continuous improvement.
• Communicate complex cybersecurity risks and recommendations clearly to technical and nontechnical stakeholders.
• Stay informed of emerging healthcare cybersecurity threats, regulatory changes, and industry best practices.