[Hiring] Senior Director of Information Risk & Governance @Modern Health

Role Description

Modern Health is scaling into enterprise and regulated clients — health plans, financial services, and global employers — whose trust depends on demonstrable information technology risk governance. Much of Modern Health's information technology risk and governance framework already exists — policies, vendor intake, access reviews, a trust center, an answer library, a risk register, incident response, and incident tooling. What this role adds is the senior ownership and oversight to establish and run our cross-functional governance programs: connecting those assets into coherent, evidenced, enterprise-credible programs, and representing our posture to strategic clients, auditors, and assessors.

The Senior Director, Information Risk & Governance is the company’s second-line-of-defense leader for information technology risk: an independent risk, governance, and assurance function reporting to the General Counsel, deliberately separated from the teams that build, operate, and execute security and IT programs. The role partners closely with the Head of Security Engineering, who continues to run operational security execution, certification readiness, audit evidence production, and day-to-day customer security response workflows. This role provides program governance, risk decision support, escalation, remediation-plan calibration, executive reporting, and client-facing support.

What you'll do:

• Information technology risk governance.
• Risk-balanced business prioritization.
• AI governance program operations.
• Incident management program.
• Data governance (security side).
• Certification & assurance programs.
• Third-party risk.
• Customer trust & enterprise assurance.
• Policy & awareness (information risk).

Qualifications

• 10+ years in information-security risk management, security governance, assurance, GRC, or security program leadership, with 5+ years in a regulated, PHI-handling environment.
• Digital health, health plan, or healthcare services experience strongly preferred.
• Experience providing senior governance, oversight, or program leadership for SOC 2, HITRUST, HIPAA Security risk assessments, ISO 27001 readiness, or comparable security assurance frameworks.
• Deep working knowledge of HIPAA Security Rule, NIST CSF 2.0, SOC 2, HITRUST, third-party risk frameworks, and customer security assurance expectations.
• Strong risk-decision judgment.
• Experience partnering with Security, IT, Legal, Privacy, Compliance, Sales, Procurement, and Product teams.
• Customer-facing credibility.
• Experience with third-party security risk programs.
• Experience with incident management program governance.
• Executive communication skills.
• Builder-integrator profile.
• Relevant certifications preferred: CISM, CRISC, CISSP, CISA, CIPP/US, HITRUST CCSFP, or similar.

Requirements

• Immigration sponsorship is not available for this position.
• Applicants must be able to maintain work authorization for the duration of employment without employer sponsorship or employer-provided training plans or attestations.

Benefits

• Medical / Dental / Vision / Disability / Life Insurance
• High Deductible Health Plan with Health Savings Account (HSA) option
• Flexible Spending Account (FSA)
• Access to coaches and therapists through Modern Health's platform
• Generous Time Off
• Company-wide Collective Pause Days
• Parental Leave Policy
• Family Forming Benefit through Carrot
• Family Assistance Benefit through UrbanSitter
• Professional Development Stipend
• 401k
• Financial Planning Benefit through Origin
• Annual Wellness Stipend
• New Hire Stipend for work-from-home setup costs
• Virtual events like active ERGs, holiday themed activities, team-building events and more
• Monthly Cell Phone Reimbursement