Director, Information Security

Connexure is a software company serving the self-funded medical benefits ecosystem. Our software helps stop loss carriers, brokers, and third-party administrators with quoting, underwriting, and administering stop loss policies. Our mission is to unify the self-funded medical ecosystem through integrated technologies, processes, and data insights. We are looking for talented and motivated individuals who align with our vision and will support the next phase of growth. 

DIRECTOR OF INFORMATION SECURITY  

As Director of Information Security (CISO), you will own Connexure's security program end to end — from policy and framework governance, through tooling strategy across endpoint and cloud, to how we respond to client security due-diligence and emerging AI risk. Reporting to the CTO, you will directly manage our Security Analyst, who owns day-to-day threat monitoring and the annual activities required to maintain our SOC 2 and HITRUST certifications. You will build the strategic and architectural layer that sits above that day-to-day work: setting the policies, choosing the tools, and making the judgment calls that keep a small, fast-moving software company secure in a highly regulated space. 

Reports to:  CTO 

FLSA Exemption:  Exempt 

Position Location:  Atlanta, GA 

PRIMARY RESPONSIBILITIES 

Security Strategy, Policy & Governance 

• Own Connexure's information security strategy, policies, and control framework end to end — writing, maintaining, and enforcing policies that hold up under SOC 2 and HITRUST audit and reflect how the company actually operates. 

• Select and maintain an internal control framework to organize the security program (for example, aligning to a recognized baseline such as NIST CSF or ISO 27001) so controls map cleanly across SOC 2, HITRUST, and client contractual requirements. 

• Maintain the risk register and drive remediation of identified gaps to closure, not just to “logged.” 

Security Architecture & Tooling 

• Own the security tooling roadmap end to end — endpoint protection, cloud security posture, identity and access management, network monitoring (including oversight of Darktrace, CrowdStrike, and related tools currently run by the Security Analyst), and email/collaboration security. 

• Evaluate, select, and manage vendor relationships for security tooling, balancing coverage against cost and operational overhead appropriate for a small engineering organization. 

• Partner with Engineering leadership on secure-by-design practices in the product development lifecycle. 

Compliance & Certification Oversight 

• Serve as the executive owner of the SOC 2 Type II and HITRUST certification programs, setting audit strategy and serving as primary point of contact for auditors and assessors. 

• Direct and develop the Security Analyst, who executes day-to-day compliance monitoring, evidence collection, and control testing. 

• Ensure certifications are maintained continuously, not rebuilt each audit cycle. 

Client & Vendor Security Risk Management 

• Own the end-to-end process for client and prospect security questionnaires and due-diligence requests, building a scalable response process (knowledge base, workflow tooling, response SLAs) rather than answering each one from scratch. 

• Partner with Sales and Legal on security-related contract terms, and represent Connexure's security posture directly in prospect and client calls when needed. 

• Own third-party / vendor security risk assessment for Connexure's own supplier and subprocessor relationships. 

Emerging AI Security & Governance 

• Track the evolving AI threat and regulatory landscape (including risks specific to large language models and AI-assisted development tools) and translate it into practical Connexure policy. 

• Own Connexure's acceptable-use policy for AI tools, including internal use by employees and any AI-related functionality in Connexure's own product. 

• Build a lightweight AI vendor risk assessment process for any third-party AI tools or subprocessors the company adopts. 

Incident Response & Resilience 

• Own and maintain the incident response plan, including tabletop exercises with engineering and leadership. 

• Lead the response to any security incident, including technical remediation, internal communication, and coordination of any legal / customer / regulatory notification obligations alongside Legal and executive leadership. 

Team Leadership & Reporting 

• Directly manage and develop the Security Analyst. 

• Report regularly to the CTO on program status, and periodically to the CEO and/or board on overall security posture, audit outcomes, and material risks. 

QUALIFICATIONS 

• 8+ years in information security, including at least 2–3 years in a leadership role owning a security program end to end (Sr. Manager, Director, Head of Security, or CISO). 

• Direct experience operating under SOC 2 Type II and/or HITRUST CSF, including working with external auditors/assessors through a full certification or renewal cycle. 

• Hands-on familiarity with a modern security tool stack spanning endpoint, network/cloud monitoring, and identity and access management — able to evaluate and direct tooling decisions, not just consume dashboards. 

• Experience managing high-volume client/vendor security questionnaires or due-diligence processes in a B2B software or SaaS environment. 

• Experience building or maturing security policy from a less mature baseline — this is a program-building role, not a maintain-the-status-quo role. 

• Strong written and verbal communication; comfortable representing security directly to clients, auditors, and executive leadership. 

PREFERRED QUALIFICATIONS 

• Experience in a regulated vertical adjacent to healthcare, insurance, or financial services data. 

• Prior experience leading or materially contributing to breach/incident response and post-incident program remediation. 

• Working knowledge of emerging AI security frameworks and risks (for example, guidance from OWASP on LLM applications or NIST's AI risk management work), and how to translate that into internal policy. 

• Relevant certification such as CISSP, CISM, or CCSP. 

• Prior experience at a company of comparable size (small software company scaling a security function from one or two people). 

WORK ENVIRONMENT 

Hybrid work environment (Tuesday–Thursday in-office). Remote work permitted on an as-needed basis throughout the year. Flexibility with schedule around general business hours. Must have reliable internet and familiarity with digital platforms. 

Job Description — This job description is intended to describe the nature and level of work being performed by individuals assigned to this position. It is not to be construed as an exhaustive list of all responsibilities and duties required of the job. Job descriptions may also be rewritten periodically to reflect any changes in the position's duties and responsibilities.