{"id":2112120,"url":"https://alion.io/job/pelago-director-information-security-compliance","title":"Director, Information Security + Compliance","company":{"id":174563,"name":"Pelago","domain":"pelagohealth.com","url":"https://alion.io/company/pelago","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":95,"open_postings":3,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":82,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":210000,"max":230000,"currency":"USD","period":"year","gross":null,"usd_annual":230000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":true,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"GDPR","optional":false},{"name":"HIPAA","optional":false},{"name":"SOC 2","optional":false},{"name":"AI Agents","optional":true},{"name":"LLM","optional":true}],"status":"live","first_seen_at":"2026-10-08T22:04:36Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-27T19:27:21Z","board_verified":true,"closed_at":null,"days_open":19,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":19},"description":"Pelago is the leading specialty substance use care provider, built on the belief that effective treatment means matching care intensity to what each member actually needs rather than defaulting to the most expensive intervention. Our programs guide members through every stage of the substance use spectrum, from unhealthy habits to active use disorders, delivering personalized treatment for tobacco, alcohol, opioid, cannabis, and stimulant use based on individual health, habits, genetics, and goals.\nWith Sona, our voice-first AI Mental Health Specialist, Pelago now applies that same clinically-driven model to mental health, pairing deep clinical expertise with technology to expand access without compromising care quality. We believe technology should make clinical care more precise and more human, not replace the judgment behind it.\nPelago has scaled to helping hundreds of employers and health plans and has already helped more than 750,000 members better manage their substance use. If you're passionate about AI and making an impact on the health of others, join us and make it happen!\nAbout Pelago Engineering:\nOur engineering team operates as empowered, outcome-oriented problem solvers, working in close partnership with product, design, and clinical teams to improve member outcomes at scale.\nAs AI transforms how software is built, we are intentionally evolving our development lifecycle so we spend less time on mechanical implementation and more time on system design, judgment, and impact.\nHow We Work:\nOutcome-driven: Engineers are given problems to solve, not just features to build. Success is measured by learning, impact, and outcomes-not velocity alone\nAI-native: We use AI across the SDLC to accelerate implementation, testing, and review. Engineers focus on defining intent, validating behavior, and designing resilient systems\nHigh autonomy, high accountability: Teams have real ownership over their domains. With autonomy comes responsibility for quality, safety, and results\nCross-functional by default: Engineers partner deeply with Product, Design, Data, and Clinical. Discovery, experimentation, and delivery are shared responsibilities\nQuality and safety matter: We build in a regulated, member-impacting domain. Reliability, observability, and correctness are first-class concerns\nWhat You’ll Do:\nInstead of task lists, anchor on ownership:\nOwn meaningful problem spaces end-to-end, from discovery through delivery and iteration\nDesign and evolve systems that support safe, scalable, AI-augmented development\nUse data and experimentation to validate whether solutions actually work\nCollaborate cross-functionally to balance member impact, clinical constraints, and technical tradeoffs\nShape how we work-our tools, processes, and culture\nWhat We Look For:\n We explicitly assess for empowerment:\nYou start with \"why\" before diving into \"how\"\nYou're energized by ambiguity and collaborative problem-shaping\nYou use AI to amplify your judgment and move faster on what matters\nYou think in systems and anticipate second-order effects\nYou want to own outcomes, not just ship features\nOverview of the Role: \nPelago's clients trust us with some of the most sensitive data a person has, and our SOC 2 Type II and HITRUST certifications are central to how we earn and keep that trust. We already hold both. The Director of Information Security & Compliance will keep that foundation strong as our business, data, and AI platform grow, setting Pelago's security strategy and leading the team that executes it. The hire we're looking for has owned accreditation outcomes in a regulated environment, is hands-on enough to do the work alongside a small team, and has the commercial judgment to make security something that accelerates deals rather than slowing engineering down.\nThis is a hybrid role with a high-collaboration rhythm (3 days/week in our NYC office).\nIn this role you will:\nOwn SOC 2 Type II and HITRUST certification end to end, including audits, remediation, and recertification.\nDevelop and manage Pelago's security roadmap, budget, and tooling, and present key risks and recommendations to the executive team and Board.\nServe as the security lead in client security reviews, RFPs, questionnaires, and partner due diligence, partnering with Sales to position our security posture as a competitive advantage.\nMaintain security policies and third-party vendor risk reviews, including reviews of new AI tools.\nAutomate evidence collection and implement continuous control monitoring so compliance scales with the business.\nOwn incident response, vulnerability management, and the penetration testing program.\nPartner with Engineering on security monitoring, disaster recovery, secure design, and the security of our AI platform.\nPartner with IT on identity and access management, and own the periodic access reviews our audits depend on.\nPartner with Legal on the privacy program (HIPAA, GDPR, BAAs) and lead breach assessments.\nLead, coach, and grow the security team as a player-coach, building the case for and hiring the next people onto the team (1-2 direct reports today).\nSet the bar for the function: clear ownership, sustainable on-call, career paths, and performance expectations.\nBuild security literacy across the company, from engineering to clinical, commercial, and operations teams.\nThe background we are looking for: \nDirect accountability for SOC 2 Type II and HITRUST outcomes.\nExperience leading information security and compliance in healthcare, health tech, or another regulated industry; strong working knowledge of HIPAA.\nCloud security expertise in a modern stack (AWS, infrastructure as code, containers, CI/CD).\nWorking knowledge across GRC, security operations, application security, and identity and access management.\nPlayer-coach leadership experience: hands-on in the work while building a team.\nSound judgment about risk in a commercial context, including when to accept risk and when to escalate.\nAbility to communicate clearly with engineers, clients, auditors, executives, and the Board\nNice to haves: \nExperience securing AI/LLM systems, agentic tools, or data used in model workflows.\nExperience scaling a security program at a Series B or C company.\nCertifications such as CISSP, CISM, CCSP, or HITRUST CCSFP.\nExperience working with US health plans, PBMs, or large self-insured employers.\nWhat you’ll love about us:\nWe have a whole host of perks for our people! From life essentials to nice-to-haves, there are more than a few good reasons to love working with us. We strive to ensure Pelago employees have equitable access to healthcare, wellbeing, time away, and then some.\nGenerous and meaningful equity package\nFull Medical, Dental, & Vision coverage \n401k Plan \nUnlimited PTO Policy, 10 paid holidays, & company wide “Me Time” Days\nPaid maternity, paternity & new parent leave\nFlexible working environment\nAnnual Learning and Development stipend to support continued learning and career development\nWellness Reimbursement Program \nAccess to Reproductive & Family Planning Care \nSubstance Use Support for employees and family members \nAt this time, we are unable to offer visa sponsorship for this position. \nPlease note that Pelago is dedicated to providing accommodations to candidates upon request. If you need accommodations at any point throughout the interview process, please reach out to your recruiter.\nBefore you apply, see how we build.\nWe write about our technical decisions, product philosophy, and the real challenges of scaling behavioral health. Read the blog → https://pelagohealth.ai/\nThe provided range reflects our US target salary range for this full-time position, which is part of our broader total compensation package, including incentive bonus program, stock options, comprehensive benefits, and incentive pay applicable to eligible roles. Individual pay within the range will vary based on a variety of factors like role-related experience and education, internal pay equity, and other relevant business factors. At Pelago, we are committed to an equitable and fair pay philosophy and review total compensation for our employees at least twice a year.\nBase Pay Range\n$210,000—$230,000 USD","description_format":"text","description_chars":8199,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Equity","Flexible schedule","Stock options","Unlimited PTO"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Health Care","Telemedicine & Virtual Care","Health Insurance & Benefits"],"lifecycle":[{"event":"open","at":"2026-10-08T22:43:42Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":18,"expected_fill_days":82,"reasons":["conf:3","win:early"],"computed_at":"2026-10-27T05:46:45Z"},"pay":{"stated_usd_annual":230000,"is_top_pay":false},"html_url":"https://alion.io/job/pelago-director-information-security-compliance","json_url":"https://alion.io/job/pelago-director-information-security-compliance.json","meta":{"generated_at":"2026-10-27T22:13:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13822,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":174563},"rest":"https://alion.io/mcp/rest/get_company?id=174563"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fpelago-director-information-security-compliance"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fpelago-director-information-security-compliance"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fpelago-director-information-security-compliance"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/pelago-director-information-security-compliance\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fpelago-director-information-security-compliance"}]}