Director, Information Security

<p><span data-ccp-props="{"335559739":200}"> </span></p>
<p><span data-contrast="none">Connexure is a software company serving the self-funded medical benefits ecosystem. Our software helps stop loss carriers, brokers, and third-party administrators with quoting, underwriting, and administering stop loss policies. Our mission is to unify the self-funded medical ecosystem through integrated technologies, processes, and data insights. We are looking for talented and motivated individuals who align with our vision and will support the next phase of growth.</span><span data-ccp-props="{"335559738":80,"335559739":80}"> </span></p>
<p><strong><span data-contrast="none">DIRECTOR OF INFORMATION SECURITY </span></strong><span data-ccp-props="{"335559738":240,"335559739":160}"> </span></p>
<p><span data-contrast="none">As Director of Information Security (CISO), you will own Connexure's security program end to end — from policy and framework governance, through tooling strategy across endpoint and cloud, to how we respond to client security due-diligence and emerging AI risk. Reporting to the CTO, you will directly manage our Security Analyst, who owns day-to-day threat monitoring and the annual activities required to maintain our SOC 2 and HITRUST certifications. You will build the strategic and architectural layer that sits above that day-to-day work: setting the policies, choosing the tools, and making the judgment calls that keep a small, fast-moving software company secure in a highly regulated space.</span><span data-ccp-props="{"335559738":80,"335559739":80}"> </span></p>
<p><span data-ccp-props="{"335559738":80,"335559739":80}"> </span></p>
<p><strong><span data-contrast="none">Reports to:</span></strong><span data-contrast="none">  CTO</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></p>
<p><strong><span data-contrast="none">FLSA Exemption:</span></strong><span data-contrast="none">  Exempt</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></p>
<p><strong><span data-contrast="none">Position Location:</span></strong><span data-contrast="none">  Atlanta, GA</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></p>
<p><strong><span data-contrast="none">PRIMARY RESPONSIBILITIES</span></strong><span data-ccp-props="{"335559738":280,"335559739":100,"335572079":6,"335572080":0,"335572081":7031342,"469789806":"single"}"> </span></p>
<p><strong><span data-contrast="none">Security Strategy, Policy & Governance</span></strong><span data-ccp-props="{"335559738":120,"335559739":60}"> </span></p>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1"><span data-contrast="none">Own Connexure's information security strategy, policies, and control framework end to end — writing, maintaining, and enforcing policies that hold up under SOC 2 and HITRUST audit and reflect how the company actually operates.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="2" data-aria-level="1"><span data-contrast="none">Select and maintain an internal control framework to organize the security program (for example, aligning to a recognized baseline such as NIST CSF or ISO 27001) so controls map cleanly across SOC 2, HITRUST, and client contractual requirements.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1"><span data-contrast="none">Maintain the risk register and drive remediation of identified gaps to closure, not just to “logged.”</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<p><strong><span data-contrast="none">Security Architecture & Tooling</span></strong><span data-ccp-props="{"335559738":120,"335559739":60}"> </span></p>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="4" data-aria-level="1"><span data-contrast="none">Own the security tooling roadmap end to end — endpoint protection, cloud security posture, identity and access management, network monitoring (including oversight of Darktrace, CrowdStrike, and related tools currently run by the Security Analyst), and email/collaboration security.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="5" data-aria-level="1"><span data-contrast="none">Evaluate, select, and manage vendor relationships for security tooling, balancing coverage against cost and operational overhead appropriate for a small engineering organization.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="6" data-aria-level="1"><span data-contrast="none">Partner with Engineering leadership on secure-by-design practices in the product development lifecycle.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<p><strong><span data-contrast="none">Compliance & Certification Oversight</span></strong><span data-ccp-props="{"335559738":120,"335559739":60}"> </span></p>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="7" data-aria-level="1"><span data-contrast="none">Serve as the executive owner of the SOC 2 Type II and HITRUST certification programs, setting audit strategy and serving as primary point of contact for auditors and assessors.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="8" data-aria-level="1"><span data-contrast="none">Direct and develop the Security Analyst, who executes day-to-day compliance monitoring, evidence collection, and control testing.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="9" data-aria-level="1"><span data-contrast="none">Ensure certifications are maintained continuously, not rebuilt each audit cycle.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<p><strong><span data-contrast="none">Client & Vendor Security Risk Management</span></strong><span data-ccp-props="{"335559738":120,"335559739":60}"> </span></p>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="10" data-aria-level="1"><span data-contrast="none">Own the end-to-end process for client and prospect security questionnaires and due-diligence requests, building a scalable response process (knowledge base, workflow tooling, response SLAs) rather than answering each one from scratch.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="11" data-aria-level="1"><span data-contrast="none">Partner with Sales and Legal on security-related contract terms, and represent Connexure's security posture directly in prospect and client calls when needed.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="12" data-aria-level="1"><span data-contrast="none">Own third-party / vendor security risk assessment for Connexure's own supplier and subprocessor relationships.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<p><strong><span data-contrast="none">Emerging AI Security & Governance</span></strong><span data-ccp-props="{"335559738":120,"335559739":60}"> </span></p>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1"><span data-contrast="none">Track the evolving AI threat and regulatory landscape (including risks specific to large language models and AI-assisted development tools) and translate it into practical Connexure policy.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="14" data-aria-level="1"><span data-contrast="none">Own Connexure's acceptable-use policy for AI tools, including internal use by employees and any AI-related functionality in Connexure's own product.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="15" data-aria-level="1"><span data-contrast="none">Build a lightweight AI vendor risk assessment process for any third-party AI tools or subprocessors the company adopts.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<p><strong><span data-contrast="none">Incident Response & Resilience</span></strong><span data-ccp-props="{"335559738":120,"335559739":60}"> </span></p>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="16" data-aria-level="1"><span data-contrast="none">Own and maintain the incident response plan, including tabletop exercises with engineering and leadership.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="17" data-aria-level="1"><span data-contrast="none">Lead the response to any security incident, including technical remediation, internal communication, and coordination of any legal / customer / regulatory notification obligations alongside Legal and executive leadership.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<p><strong><span data-contrast="none">Team Leadership & Reporting</span></strong><span data-ccp-props="{"335559738":120,"335559739":60}"> </span></p>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="18" data-aria-level="1"><span data-contrast="none">Directly manage and develop the Security Analyst.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="19" data-aria-level="1"><span data-contrast="none">Report regularly to the CTO on program status, and periodically to the CEO and/or board on overall security posture, audit outcomes, and material risks.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<p><strong><span data-contrast="none">QUALIFICATIONS</span></strong><span data-ccp-props="{"335559738":280,"335559739":100,"335572079":6,"335572080":0,"335572081":7031342,"469789806":"single"}"> </span></p>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="20" data-aria-level="1"><span data-contrast="none">8+ years in information security, including at least 2–3 years in a leadership role owning a security program end to end (Sr. Manager, Director, Head of Security, or CISO).</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="21" data-aria-level="1"><span data-contrast="none">Direct experience operating under SOC 2 Type II and/or HITRUST CSF, including working with external auditors/assessors through a full certification or renewal cycle.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="22" data-aria-level="1"><span data-contrast="none">Hands-on familiarity with a modern security tool stack spanning endpoint, network/cloud monitoring, and identity and access management — able to evaluate and direct tooling decisions, not just consume dashboards.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="23" data-aria-level="1"><span data-contrast="none">Experience managing high-volume client/vendor security questionnaires or due-diligence processes in a B2B software or SaaS environment.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="24" data-aria-level="1"><span data-contrast="none">Experience building or maturing security policy from a less mature baseline — this is a program-building role, not a maintain-the-status-quo role.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="25" data-aria-level="1"><span data-contrast="none">Strong written and verbal communication; comfortable representing security directly to clients, auditors, and executive leadership.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<p><strong><span data-contrast="none">PREFERRED QUALIFICATIONS</span></strong><span data-ccp-props="{"335559738":280,"335559739":100,"335572079":6,"335572080":0,"335572081":7031342,"469789806":"single"}"> </span></p>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="26" data-aria-level="1"><span data-contrast="none">Experience in a regulated vertical adjacent to healthcare, insurance, or financial services data.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="27" data-aria-level="1"><span data-contrast="none">Prior experience leading or materially contributing to breach/incident response and post-incident program remediation.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="28" data-aria-level="1"><span data-contrast="none">Working knowledge of emerging AI security frameworks and risks (for example, guidance from OWASP on LLM applications or NIST's AI risk management work), and how to translate that into internal policy.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="29" data-aria-level="1"><span data-contrast="none">Relevant certification such as CISSP, CISM, or CCSP.</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<ul>
<li data-leveltext="●" data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="30" data-aria-level="1"><span data-contrast="none">Prior experience at a company of comparable size (small software company scaling a security function from one or two people).</span><span data-ccp-props="{"335559738":60,"335559739":60}"> </span></li>
</ul>
<p><strong><span data-contrast="none">WORK ENVIRONMENT</span></strong><span data-ccp-props="{"335559738":280,"335559739":100,"335572079":6,"335572080":0,"335572081":7031342,"469789806":"single"}"> </span></p>
<p><span data-contrast="none">Hybrid work environment (Tuesday–Thursday in-office). Remote work permitted on an as-needed basis throughout the year. Flexibility with schedule around general business hours. Must have reliable internet and familiarity with digital platforms.</span><span data-ccp-props="{"335559738":80,"335559739":80}"> </span></p>
<p><em><span data-contrast="none">Job Description — This job description is intended to describe the nature and level of work being performed by individuals assigned to this position. It is not to be construed as an exhaustive list of all responsibilities and duties required of the job. Job descriptions may also be rewritten periodically to reflect any changes in the position's duties and responsibilities.</span></em><span data-ccp-props="{"335559738":400,"335559739":80,"335572071":4,"335572072":0,"335572073":13421772,"469789798":"single"}"> </span></p>