Virtual Chief Information Security Officer (vCISO)

Location: Remote (United States)

Type: Fractional / Contract

Compensation: Competitive, based on experience and scope

About Triplemoon

Triplemoon is a digital health platform transforming family wellness by addressing critical gaps in mental, behavioral, and nutritional health. We partner with providers, employers and ultimately families to provide accessible, evidence-based mental health resources that improve patient outcomes, increase provider capacity, and boost clinic financials. With growing demand for tailored, mental health resources amidst a shortage of providers (with wait times exceeding 4-6 weeks), Triplemoon is uniquely positioned to solve a critical gap in care for families and clinics. As we grow our collaborative care offering we are adding to our team.

The Opportunity

Triplemoon is seeking a Virtual Chief Information Security Officer (vCISO) to oversee and continuously strengthen our information security, IT operations, and compliance posture. As a fully remote healthcare organization, we rely on secure, scalable technology systems to support our employees, patients, and provider partners.

This role combines strategic information security leadership with hands-on operational oversight. The ideal candidate will serve as Triplemoon's trusted security advisor, ensuring our systems remain secure, compliant, and audit-ready while providing responsive support to our growing remote workforce.

Responsibilities

Information Security & Compliance

• Own the strategy, design, implementation, and continuous improvement of Triplemoon's information security and compliance program.
• Ensure ongoing compliance with HIPAA and healthcare security best practices.
• Lead readiness efforts for future SOC 2 certification and other security frameworks as needed.
• Develop, maintain, and document security policies, procedures, and controls.
• Coordinate security incident response, investigation, remediation, and post-incident reviews.
• Support customer security questionnaires, audits, and compliance requests.
• Partner with leadership to identify, assess, and mitigateinformation security risks.

IT Operational Oversight

• Manage and oversee an IT MSP or MSSP who can:
• • Implement security controls and compliance within SaaS vendors and IT systems
  • Provide tiered end-user support for hardware, software, and SaaS application issues
  • Provide device and asset management
  • Manage identity and access, including systems for onboarding and offboarding
• Maintain system documentation, operating procedures, and technology standards.
• Recommend and implement improvements to strengthen security, scalability, and user experience.

Vendor Risk Management

• Conduct security reviews of third-party vendors and software platforms.
• Maintain required security documentation, including BAAs, DPAs, SOC reports, and related compliance artifacts.
• Monitor vendor compliance and support periodic risk assessments.

Qualifications

• 7+ years of experience in information security, IT administration, compliance, or related roles.
• Experience serving as a vCISO, security leader, or senior security consultant.
• Strong knowledge of HIPAA Security Rule requirements and healthcare security best practices.
• Experience preparing organizations for SOC 2 audits and other compliance frameworks.
• Experience supporting early-stage startups or high-growth healthcare organizations.
• Hands-on experience administering Google Workspace, identity management platforms, endpoint management tools, and SaaS environments.
• Familiarity with remote workforce security and cloud-first technology environments.
• Excellent documentation, communication, and stakeholder management skills.
• Ability to operate independently while serving as a strategic advisor to company leadership.

Preferred Qualifications

• Experience working with and configuring cloud-native SaaS stacks for regulatory compliance, such as Vanta, 1Password, Google Workspace, Rippling, and other cloud-based healthcare technology platforms.

Success in This Role

The successful vCISO will ensure that:

• Triplemoon maintains a strong security and compliance posture.
• Security controls are documented, monitored, and continuously improved.
• Systems remain reliable and well-supported for a fully remote workforce.
• Customer security reviews and audits are completed efficiently and confidently.
• Triplemoon remains audit-ready and positioned for future compliance milestones, including SOC 2 readiness.
• IT issues, including onboarding and offboarding, are handled securely and consistently.