Sr Director Information Security

This is a rare opportunity to join a team that is bringing an entirely new category of brain health to the world. At Cognito we are developing therapies designed to promote dignity clarity and coherence in the lives they touch.


Cognito is a neurotechnology company developing a new therapeutic approach to cognitive and neurological health designed to work with the brains own activity and biology. Born from pioneering neuroscience research at MIT Cognito brings together neuroscience engineering medicine and technology to translate breakthroughs in brain science into practical therapies designed for everyday life.


Our first therapeutic application Spectris AD is an investigational prescription at-home therapy for Alzheimers disease. With our pivotal HOPE study now complete Cognito is entering an important new phase as we advance Spectris AD toward regulatory review prepare for potential commercialization and continue exploring the broader potential of our science across neurological health.


We are building an interdisciplinary team united by a shared purpose: protecting and progressing the human ability to think learn and remember. For innovators who want to work at the intersection of breakthrough science technology and human health Cognito offers the chance to help shape what comes next.

About the Job

Cognito is building a Security Privacy and IT organization from the ground up under the SVP of Security Privacy and IT structured across three functions. The Information Security Director leads the Information Security function day-to-day hiring and running the team and driving SOC 2 and HIPAA audit readiness to completion with HITRUST in the future under the strategic direction of the SVP who holds overall executive (CISO-level) accountability for security.

Responsibilities

Build & Lead the Information Security Function

• Stand up and run Information Security day-to-day: hire and manage a team.

• Set team goals and performance expectations as the function grows through 2028.

Certification & Audit Readiness

• Drive SOC 2 and HIPAA audit preparation and execution end-to-end scoping control implementation evidence collection and auditor coordination.

• Build toward the multi-year HITRUST certification goal reporting progress and risk up to the SVP.

Policy Risk & Vendor Management

• Build and maintain the information security policy set (access control data protection vendor risk incident response etc) that the rest of the team will operate against.

• Establish a vendor security review process for new tools and vendors as the company scales.

Client & Partner Security Support

• Serve as the day-to-day technical security contact in partner and client diligence conversations escalating to the SVP for executive-level or strategic discussions.

Interim Leadership & Team Growth

• Provide an interim reporting home for the Privacy Analyst until the Privacy Director is hired.

• Hire and ramp the Security team.

Reporting & Program Execution

• Define security KPIs and report on them regularly to the SVP and to the broader leadership team or board as needed.

• Execute the security roadmap and budget set together with the SVP and surface risks tradeoffs and resourcing needs as they come up.

Qualifications

Required

• 10 years in information security including experience leading a team or sub-function at the Director level.

• Direct experience running SOC 2 and/or HIPAA audits and preparing an organization for certification.

• Comfort operating as the day-to-day technical lead in client/partner diligence conversations.

• Experience building and managing a team from a small base.

• Experience developing and maintaining a security policy framework.

• Familiarity with a recognized security control framework (e.g. NIST CSF ISO 27001 or similar).

Preferred

• Bachelors degree in Cybersecurity Computer Science Information Technology Information Systems Engineering or a related field

• HITRUST certification experience.

• CISSP CISM CRISC or CISA certifications.

• Experience in a regulated FDA-adjacent or medical device environment.

• Prior ownership of vendor/partner risk management or RFP/RFI security response.

• Experience presenting security metrics or risk posture to a leadership team or board.

• Experience running a security awareness training program.

Other

• Remote (USA) position; flexibility required during peak periods which may include supporting critical operations outside normal business hours as needed.

Competitive Benefits

Taking care of our own is one of our highest priorities. Thats why we offer benefits including unlimited PTO wellness perks virtual medical support and health dental and vision insurance.

Physical Requirements & Work Environment

This role is primarily performed in an office or home-office setting. Essential physical requirements include the ability to work at a computer for extended periods communicating effectively in written and verbal formats and participate in video and in-person meetings.

Occasional travel to partner sites may be required. For remote roles occasional travel to Cognitos Cambridge MA office may also be required.

Cognito Therapeutics is committed to providing reasonable accommodation for qualified individuals with disabilities throughout the application and hiring process. If you require accommodation please contact us at

Cognito Therapeutics is an Equal Opportunity Employer. We are committed to building a diverse and inclusive workplace and make employment decisions based on qualifications merit business needs and job requirements. We do not discriminate on the basis of race color religion sex sexual orientation gender identity or expression national origin age disability veteran status genetic information or any other characteristic protected by applicable federal state or local law.

All applicants must be legally authorized to work in the United States.

Required Experience:

Exec