Head of Information Security

Who you are

• Experience: 5+ years experience leading cybersecurity, information security, or security engineering in a complex, fast-growing organization and have owned outcomes
• Technical depth: You can operate credibly across identity and access management, endpoint security, cloud infrastructure, application security, incident response, vulnerability management, and corporate systems
• Builder: You have built or significantly improved a security program, including its roadmap, controls, policies, tooling, processes, and operating model
• Autonomy: You are comfortable entering an environment that is still evolving, identifying what needs to be done, and driving it through to completion with limited structure
• Judgement: You can identify the risks that genuinely matter, explain them clearly, and implement proportionate controls without creating unnecessary friction or slowing the business down
• Incident leadership: You have managed security incidents or high-severity technical issues and can lead calmly through investigation, containment, communication, recovery, and remediation
• Influence: You can work effectively with engineering, operations, legal, compliance, people, clinical, and executive teams, even when you do not directly manage the people responsible for implementation
• Data Protection: You have worked in an environment handling highly sensitive customer, patient, financial, employee, or similarly regulated data
• Healthcare Experience: You have worked in digital health, telemedicine, pharmacy, clinical operations, health insurance, or another healthcare environment
• International Experience: You have owned security across multiple countries, legal entities, or business units, particularly across the US, UK, and Europe
• Compliance: You have supported or led programs involving HIPAA, GDPR, UK GDPR, SOC 2, ISO 27001, or similar security and privacy frameworks
• IT Ownership: You have managed identity platforms, device management, endpoint protection, productivity systems, employee lifecycle processes, and internal support operations
• Scaling: You have hired, developed, or managed security and systems professionals and know what capabilities should remain internal versus outsourced

What the job involves

• We are building a world-class team
• As Head of Information Security & Systems at AIOS, your fundamental role is to build the secure foundation that allows us to scale globally without compromising patient trust, operational resilience, or speed
• You’ll own cybersecurity and internal systems across the AIOS group, spanning our healthcare businesses, technology platforms, pharmacy infrastructure, and more. This includes security strategy, identity and access management, endpoint security, incident response, architecture, tooling and overall security compliance
• You’ll turn that strategy into a consistent, scalable operating model across our entities and geographies. You’ll set clear standards, strengthen controls, establish ownership across teams, and ensuring risks are identified, prioritized, and actually resolved as the business grows
• This is both a strategic and hands-on role. You’ll advise leadership on material risks while also diving in to investigate issues, improve controls, review architecture, implement tooling, and drive remediation across the business
• Great performance in this role means we can move faster because our systems are secure, resilient, and scalable; teams understand their responsibilities; leadership has clear visibility into risk; and patients, employees, partners, and regulators can trust how we protect their data
• You’ll report directly to Joey Gracek, Head of Business Operations
• You’ll also work most closely with:
• Gzim Helshani (VP Engineering)
• Jordan Pellikan (Chief of Staff)
• Security ownership: You own the cybersecurity strategy, roadmap, and operating model across all Aios entities and geographies
• Security operations and incident response: You establish the systems and processes needed to detect, investigate, contain, and recover from security incidents. You lead the response when issues arise and ensure lessons are translated into stronger controls
• Identity, access, and endpoint security: You ensure the right people have the right access to the right systems. You build scalable processes for authentication, permissions, employee onboarding and offboarding, device management, and overall access
• Application and infrastructure security: You partner closely with engineering to strengthen the security of our applications, APIs, cloud infrastructure, development processes, and sensitive data. You review architecture, identify vulnerabilities, and drive remediation without unnecessarily slowing product development
• Risk and compliance: You translate healthcare, privacy, and security requirements into practical controls across the business. You lead security risk assessments, audits, diligence requests, policy development, and readiness for frameworks such as HIPAA, GDPR, SOC 2, and ISO 27001
• Business continuity and resilience: You ensure Aios can continue operating through system failures, security incidents, and other disruptions. You strengthen backups, recovery procedures, incident plans, and the resilience of business-critical systems
• Third-party security: You assess and manage the risks created by vendors, partners, contractors, acquisitions, and new market launches. You ensure third parties meet appropriate security standards and that identified risks are actively resolved
• Security leadership and culture: You make security a clear and practical responsibility across Aios. You advise leadership on material risks, establish ownership across teams, train employees, and build the internal team and external partner network required as the company scales

Benefits

• Vacation: paid time-off with a yearly minimum (≥2wks + local national holidays)
• Healthcare: comprehensive medical insurance (if appropriate)
• Personal development: budget for books, courses, coaching
• Personal wellness: budget for gym, health apps
• Health coaching: free biweekly health coaching so you stay healthy
• Work coaching: free biweekly work coaching so you stay sharp + calm
• Equipment: WFH gear provided as needed, inc Macbook