Vice President, Information Security

Job Description

Job Description

Our mission: e liminating every barrier to mental health.

Spring Health is a global mental health company on a mission to eliminate every barrier to mental health. We're building a world where getting support is simple, personal, and built around the person, so care can continue through every job, move, health plan, and life stage.

Our AI-native platform helps us deliver personalized support across self-guided tools, coaching, therapy, medication management, and specialty care. With outcomes independently validated by JAMA Network Open and the Validation Institute, Spring Health reaches more than 170 million people worldwide through leading employers, health plans, and partners.

As an AI-native company, we believe technology should expand the reach, quality, and humanity of care. Every Spring Health team member is expected to use AI tools thoughtfully, apply human judgment to AI outputs, and keep building AI fluency in ways that support their role and our mission.

Reporting to the CISO, the Vice President, Information Security will lead Spring Health's Security Operations and Application/Product Security functions, ensuring the protection of company assets, customer data, and critical systems while enabling business growth and innovation. This leader will provide strategic and hands-on direction across threat detection and response, vulnerability management, application and cloud security, secure software development, security architecture, incident response, compliance execution, audit readiness, and enterprise customer-facing security strategy.

The VP, Information Security will partner closely with the CISO, Engineering, Product, Legal, Compliance, Sales, Customer Success, and enterprise customers to strengthen Spring Health's security posture and embed security into product and engineering decision-making. This leader will help mature Spring's operational, product security, and compliance capabilities, support customer trust with large enterprise clients, and ensure Spring remains resilient against evolving cyber threats while balancing security, regulatory obligations, innovation, and business velocity.

This is a remote position with frequent travel required for leadership on-sites in NYC and occasional travel to our other offices in San Francisco and Seattle.

What You'll Do

• Lead Spring Health's Security Operations and Application/Product Security functions, including threat detection, vulnerability management, incident response, application security, cloud security, and secure SDLC practices.
• Develop and execute the roadmap for Security Operations and Application/Product Security in alignment with Spring Health's broader information security strategy.
• Partner closely with the CISO, Engineering, Product, Legal, Compliance, Sales, Customer Success, and IT to strengthen Spring Health's security posture while enabling business growth and innovation.
• Own the day-to-day execution of Spring Health's information security compliance programs, partnering with the CISO, Legal, Privacy, and Compliance teams to maintain audit readiness and strong control discipline.
• Serve as a senior security leader in strategic enterprise customer conversations, including security reviews, audits, RFPs/RFIs, technical diligence, and customer escalations.
• Build scalable processes, artifacts, and technical narratives that help enterprise customers understand and trust Spring Health's security practices.
• Ensure customer-facing security and compliance materials accurately reflect Spring Health's controls, certifications, policies, remediation plans, and risk posture.
• Translate customer security requirements and recurring diligence themes into actionable product, engineering, and security priorities.
• Embed security throughout the software development lifecycle, including threat modeling, secure design reviews, secure code review, automated security testing, CI/CD controls, and vulnerability remediation.
• Provide security architecture review and guidance for new products, features, cloud environments, data flows, and third-party integrations.
• Own the Security Operations function and related tooling strategy, including SIEM, threat intelligence, endpoint detection and response, automation, alert triage, and response workflows.
• Lead the operational response to security incidents, including technical investigation, containment, remediation, executive updates, post-incident review, and partnership with Legal and Compliance on regulatory obligations.
• Oversee vulnerability management, penetration testing, responsible disclosure or bug bounty processes, and remediation programs across applications, cloud environments, and infrastructure.
• Lead audit readiness and certification execution for information security programs, including evidence collection, technical control validation, remediation tracking, and partnership with the CISO, Legal, Privacy, and Compliance teams on frameworks such as HITRUST, SOC 2, ISO 27001, HIPAA, and PCI DSS.
• Build, mentor, and develop high-performing Security Operations and Application/Product Security teams.
• Manage budgets, technology investments, vendor relationships, and tooling strategy for Security Operations and Application/Product Security.
• Drive a security culture across Engineering, Product, and business teams that enables innovation while maintaining appropriate risk controls.

What Success Looks Like

• A documented Security Operations and Application/Product Security roadmap is in place with clear milestones, KPIs, ownership, and measurable progress.
• Strong technical control and compliance outcomes that support successful audits, certifications, customer reviews, and ongoing regulatory readiness.
• Compliance programs are operationally well-run, with clear ownership, timely evidence collection, effective remediation tracking, and strong partnership across Security, Legal, Privacy, Engineering, Product, and IT.
• Reduced organizational risk through proactive threat detection, vulnerability remediation, and security architecture, and effective technical security controls.
• High levels of security resilience demonstrated through effective incident response and crisis management.
• Security is embedded in the SDLC, development teams have clear security requirements, tooling, and a consistent process for security review.
• Enterprise client security questionnaires and audits are handled efficiently, with documented repeatable processes that reduce friction for the Sales and Customer Success teams.
• Meaningful improvements in security awareness and accountability across the organization.
• Executive leadership, customers, partners, and regulators have confidence in the company's security posture.
• A highly engaged, high-performing security team with strong retention

What You'll Bring

• 12+ years of progressive experience in Information Security, with at least 5 years in a senior leadership role.
• Demonstrated experience building and leading multi-functional security teams, especially across Security Operations, Application/Product Security, cloud security, vulnerability management, and incident response.
• Demonstrated ability to communicate security risk to executive engineering, product, and customer audiences, translating technical issues into business impact, customer impact, and clear mitigation plans.
• Strong working knowledge of HIPAA and healthcare security requirements, with experience owning or operationally leading security compliance work in covered entity or business associate environments.
• Experience leading or supporting HITRUST CSF, SOC 2, ISO 27001, PCI DSS, and comparable certification programs through strong technical controls, remediation management, evidence support, audit readiness, and cross-functional partnership.
• Experience translating compliance requirements into practical security controls, engineering requirements, operational processes, and customer-facing narratives.
• One or more recognized industry certifications relevant to a role at this level preferred such as CISSP, CISM, CCISO, CRISC, or CISA.
• Experience building partnerships across the organization, enabling innovation in a safe and risk-aware way — a track record of being a business enabler, not a gatekeeper.
• Experience serving as a senior security leader in client-facing enterprise security reviews, audits, RFP/RFI responses, technical diligence, and customer escalations.
• Experience owning operational incident response programs and partnering with Legal, Compliance, and executive stakeholders on breach assessment, communications, and notification obligations.
• Strong working knowledge of cloud security principles and modern SaaS architecture security requirements.
• Track record of partnering effectively with executive leadership, Engineering, Product, Legal, Compliance, Sales, Customer Success, auditors, and enterprise customers.
• Deep knowledge of security operations, threat management, vulnerability management, and incident response.
• Strong expertise in cloud security, application security, identity and access management, and security architecture.
• Strategic mindset with strong business and risk management acumen.
• Ability to balance security requirements with customer experience, innovation, and business objectives.

The target base salary range for this position is $250,000 - $291,000 , and is part of a competitive total rewards package including equity and benefits. Individual pay may vary from the target range and is determined by a number of factors including experience, location, internal pay equity, and other relevant business considerations. We review all employee pay and compensation programs annually using Radford Global Compensation Database at minimum to ensure competitive and fair pay.

Benefits provided by Spring Health:

Note : We have even more benefits than listed here and below, your recruiter will provide more in-depth information as you continue in the interview process. Benefits are subject to individual plan requirements and eligibility criteria.

• Health, Dental, Vision benefits start on your first day at Spring. You and your dependents also receive access to One Medical accounts HSA and FSA plans are also available, with Spring contributing up to $1K for HSAs, depending on your plan type.
• Employer sponsored 401(k) match of up to 2% for retirement planning
• A yearly allotment of no cost visits to the Spring Health network of therapists, coaches, and medication management providers for you and your dependents.
• We offer competitive paid time off policies including vacation, sick leave and company holidays.
• At 6 months tenure with Spring, we offer parental leave of 18 weeks for birthing parents and 16 weeks for non-birthing parents.
• Access to Noom , a weight management program—based in psychology, that's tailored to your unique needs and goals.
• Access to fertility care support through Carrot , in addition to $4,000 reimbursement for related fertility expenses.
• Access to Wellhub , which connects employees to the best options for fitness, mindfulness, nutrition, and sleep in one subscription
• Access to BrightHorizons , which provides sponsored child care, back-up care, and elder care
• Up to $1,000 Professional Development Reimbursement a year.
• $200 per year donation matching to support your favorite causes.

Not sure if you meet every requirement? Research shows that women and people from historically underrepresented communities often hesitate to apply for roles unless they meet every qualification compared to other similarly-qualified candidates. At Spring Health, we are committed to fostering a workplace where everyone feels valued, empowered, and supported to Thrive. If this role excites you, we encourage you to apply.

Our privacy policy: -policy/

Spring Health is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex, marital status, ancestry, disability, genetic information, veteran status, gender identity or expression, sexual orientation, pregnancy, or other applicable legally protected characteristic. We also consider qualified applicants regardless of criminal histories, consistent with applicable legal requirements. Spring Health is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans. If you have a disability or special need that requires accommodation, please let us know.