Senior Manager, Information Security

The Senior Manager, Information Security leads the day-to-day execution of the information security program across Vatica Health + Cozeva, protecting healthcare data, systems, and platforms. This role translates the security strategy into prioritized work, effective controls, and measurable improvements in risk reduction and incident readiness.

The Senior Manager leads and develops security professionals and partners with Engineering, Infrastructure, DevOps, Compliance, and business leaders to embed security into technology delivery and operations. The role combines technical judgment with disciplined execution, clear communication of business risk, and accountability for resolving security gaps.

RESPONSIBILITIES

• Security Program and Team Leadership: Translate the security roadmap into priorities, delivery plans, and team goals. Assign ownership, monitor progress, and escalate resource constraints and unresolved risks. Coach team members, manage performance, and oversee security vendors, projects, and approved budgets.
• Security Engineering and Vulnerability Management: Lead security control implementation across Azure, AWS, and on-premises environments. Partner with technical owners on architecture reviews, secure design, threat modeling, and security checks in software delivery pipelines. Prioritize vulnerabilities by exposure and business impact, track remediation with accountable owners, and verify closure.
• Cloud Infrastructure and Data Protection: Oversee cloud configuration monitoring, identity and privileged access controls, endpoint and network protection, encryption, and data loss prevention. Partner with Infrastructure and Engineering to address control gaps and advance Zero Trust practices.
• Security Operations and Incident Response: Oversee monitoring, threat detection, investigation, and response. Lead technical incident coordination, containment, and recovery with system owners; escalate promptly to leadership and Compliance. Maintain response plans, conduct exercises and lessons-learned reviews, and track corrective actions. Support disaster recovery and business continuity testing.
• Governance Risk and Assurance: Maintain security policies, standards, risk assessments, and control evidence in partnership with Compliance. Support applicable HIPAA obligations, HITRUST requirements, SOC 2 examinations, and internal reviews. Track findings through remediation and report control effectiveness, risk trends, and decisions needed from leadership.
• AI and Emerging Technology Security: Assess security risks in AI tools, external services, and third-party integrations. Implement safeguards against sensitive data exposure and unauthorized access. Partner with Engineering and Compliance on approved use, access controls, and monitoring, and evaluate emerging threats and security technologies.

Requirements

• Bachelor’s degree in Information Security, Computer Science, Information Technology, or a related field, or equivalent practical experience.
• 10+ years of progressive experience in cybersecurity, information security, or security engineering, including 2+ years leading security teams or managing security programs.
• Demonstrated success translating security priorities into implemented controls, resolved findings, and measurable operational improvements in a regulated environment.
• Hands-on experience with cloud and enterprise security, including Azure and AWS, identity and access management, endpoint protection, network security, encryption, and key management.
• Experience with security monitoring and SIEM platforms, endpoint detection and response, web application firewalls, data loss prevention, and vulnerability management tools.
• Experience leading incident response and coordinating remediation across technical teams; working knowledge of secure software development, DevSecOps, and Zero Trust principles.
• Ability to assess business risk, set priorities, communicate recommendations to technical and business audiences, and drive follow-through across teams.

PREFERRED QUALIFICATIONS

• Experience protecting healthcare environments and protected health information (PHI), with knowledge of HIPAA, HITRUST, SOC 2, and the NIST Cybersecurity Framework.
• Experience securing cloud-native platforms, AI-enabled applications, and third-party AI integrations.
• Relevant security certification such as CISSP, CISM, CCSP, GIAC, or a cloud security certification.