Chief Information Security Officer

About Matter Health
Matter Health delivers primary and preventive healthcare directly to older adults living in affordable housing communities. Our mission is simple: to improve healthcare access by meeting patients where they are and building trusted relationships within the communities we serve.
As we rapidly expand, we are seeking mission-driven professionals who thrive in fast-paced, people-centered environments.
We Lead with Love in Everything We Do.
About the Role
Matter Health is seeking an experienced Chief Information Security Officer (CISO) to lead and continuously strengthen our enterprise information security program.
Our value-based care model depends on the trust of our patients, providers, and payer partners. Protecting sensitive health information across our distributed, field-based care delivery model is essential to maintaining that trust.
Reporting to the Chief Technology Officer, the CISO will be responsible for developing and executing Matter Health 's information security strategy, establishing security policies and governance frameworks, overseeing cybersecurity operations, and ensuring compliance with applicable healthcare security regulations.
This is a high-visibility, hands-on executive leadership opportunity for someone who enjoys building and scaling security programs within a growing healthcare organization. The CISO will work closely with Technology, Clinical Operations, Compliance, and executive leadership to strengthen organizational security while supporting continued growth.
The position will initially oversee a cybersecurity analyst and work alongside an external contractor supporting Matter Health 's HITRUST certification efforts.
The ideal candidate brings deep healthcare cybersecurity expertise, strong executive leadership capabilities, and the ability to balance enterprise-level security standards with the flexibility and adaptability required in a growth-stage environment.
Key Responsibilities
Information Security Strategy & Leadership
Develop, implement, and continuously evolve Matter Health 's enterprise information security strategy, ensuring alignment with organizational goals, clinical operations, and regulatory requirements.
Establish and maintain security policies, standards, and procedures covering data protection, access controls, acceptable use, and third-party risk management.
Build and mature security governance frameworks, including NIST CSF and HITRUST CSF, appropriate for an organization handling protected health information (PHI).
Lead security budget planning, vendor selection, and technology investments while balancing security needs with organizational priorities.
Manage and develop internal cybersecurity resources while collaborating with external security partners and consultants.
Provide regular security updates, risk assessments, and strategic recommendations to executive leadership, including occasional presentations to the Board of Directors.
Cybersecurity Operations & Risk Management
Oversee threat detection, intrusion prevention, security monitoring, and Security Information and Event Management (SIEM) and Security Operations Center (SOC) operations.
Lead cybersecurity incident response, including incident investigation, containment, remediation, and recovery.
Develop and maintain incident response plans, coordinate tabletop exercises, and oversee organizational preparedness for potential security incidents.
Direct vulnerability management, penetration testing, and remediation programs across infrastructure, applications, and third-party integrations.
Oversee identity and access management (IAM), including privileged access management, role-based controls, and least-privilege principles.
Partner with Technology to maintain secure cloud infrastructure, encryption, and data protection practices.
Oversee endpoint and mobile device security for clinical and field-based employees working in patients' homes.
Partner with Technology and Clinical Operations on business continuity and disaster recovery planning to support operational resilience.
Healthcare Security, Compliance & Governance
Ensure compliance with the HIPAA Security Rule, HITECH, and applicable federal and state healthcare security requirements.
Partner with Compliance on patient privacy, regulatory reporting, breach notification obligations, and related requirements.
Support organizational HITRUST certification initiatives, including security control implementation, readiness activities, remediation, and ongoing compliance.
Maintain security readiness for regulatory audits, payer security assessments, and third-party evaluations.
Oversee vendor and third-party security risk management, including security reviews of business associates and partners handling protected health information.
Serve as a primary security contact for payer questionnaires, security attestations, audits, and due diligence requests.
Maintain working knowledge of Medicare, Medicaid, Medicare Advantage, CMS guidance, and payer-specific security expectations.
Collaboration & Security Culture
Partner with Technology, Engineering, Compliance, Legal, and Clinical Operations to integrate security into business processes and technology initiatives.
Develop and oversee organization-wide security awareness and training programs.
Promote a culture of security accountability, risk awareness, and continuous improvement.
Communicate complex cybersecurity risks and recommendations clearly to technical and nontechnical stakeholders.
Stay informed of emerging healthcare cybersecurity threats, regulatory changes, and industry best practices.
Qualifications
Bachelor's degree in Information Security, Computer Science, Information Systems, or a related field; equivalent experience will be considered.
10+ years of progressive information technology and cybersecurity experience, including significant experience in healthcare environments handling protected health information.
At least 5 years of experience in a CISO, Head of Security, or comparable senior cybersecurity leadership role.
Demonstrated experience building, implementing, and leading enterprise information security programs.
Strong knowledge of HIPAA, HITECH, and applicable healthcare security regulations.
Experience overseeing cybersecurity operations, incident response, security monitoring, and enterprise risk management.
Hands-on experience with cloud security, identity and access management, endpoint security, and security governance.
Experience with SIEM platforms and oversight of internal or outsourced security operations centers.
Proven experience leading security incident investigations, containment, remediation, and recovery activities.
Demonstrated ability to develop security policies, establish governance frameworks, and manage third-party security risks.
Experience managing, mentoring, and developing cybersecurity professionals.
Strong communication skills with the ability to present security strategy and risk assessments to executive leadership.
Ability to work collaboratively across Technology, Compliance, Legal, and Clinical Operations.
Willingness and ability to travel occasionally, up to approximately 15%.
Strongly Preferred
Master's degree in Information Security, Computer Science, Information Systems, or a related field.
Experience working in a startup, high-growth, or rapidly evolving healthcare organization.
Experience leading or supporting HITRUST CSF certification, readiness assessments, and ongoing compliance.
Experience securing Medicare, Medicaid, or Medicare Advantage healthcare environments.
Familiarity with CMS security requirements, payer security assessments, and healthcare regulatory expectations.
Experience securing integrations with electronic health record and patient engagement platforms, including athenahealth and Salesforce.
Professional security certifications such as CISSP, CISM, CRISC, HCISPP, or equivalent.
Experience communicating cybersecurity stra