Why Charlie Health?

Millions of people across the country are navigating mental health conditions, substance use disorders, and eating disorders, but too often, they’re met with barriers to care. From limited local options and long wait times to treatment that lacks personalization, behavioral healthcare can leave people feeling unseen and unsupported.

Charlie Health exists to change that. Our mission is to connect the world to life-saving behavioral health treatment. We deliver personalized, virtual care rooted in connection—between clients and clinicians, care teams, loved ones, and the communities that support them. By focusing on people with complex needs, we’re expanding access to meaningful care and driving better outcomes from the comfort of home.

As a rapidly growing organization, we're reaching more communities every day and building a team that’s redefining what behavioral health treatment can look like. If you're ready to use your skills to drive lasting change and help more people access the care they deserve, we’d love to meet you.

About the Role

The Director of Information Security is responsible for leading the execution and continued maturity of Charlie Health’s information security program. Reporting to the VP of IT & CISO, this role will lead the Information Security team, translate security strategy into measurable outcomes and ensure security capabilities scale with the business.

This role requires broad leadership experience across security engineering, security operations, governance, risk, compliance, identity, cloud security, application security and data protection. The Director will work closely with IT, Engineering, Compliance, Legal, Privacy, Product and business leadership to reduce risk while enabling Charlie Health to move quickly and safely.

Charlie Health operates in a highly regulated healthcare environment. This role will help ensure security capabilities align with HIPAA, SOC 2, NIST, Zero Trust principles and other applicable regulatory and contractual requirements.

Responsibilities

Key Responsibilities

Security Program Leadership

Translate CISO and executive strategy into clear priorities, roadmaps and measurable security outcomes
Lead and develop the Information Security team, including hiring, coaching, performance management and organizational planning
Establish security metrics, operating rhythms and reporting that provide clear visibility into risk, control maturity and program performance

Security Engineering & Operations

Provide leadership across security engineering, architecture, security operations, incident response, identity, cloud, application security and data protection
Partner with IT and Engineering to embed secure-by-design practices, automation and modern engineering practices that improve control effectiveness, consistency and operational efficiency
Lead security incident readiness and response, including coordination with internal teams, managed security providers and external partners

Governance, Risk & Business Partnership

Lead operational security capabilities supporting HIPAA, SOC 2, NIST and other applicable requirements
Identify, assess and prioritize security risk based on business impact, materiality and organizational priorities
Partner with leaders across Compliance, Legal, Privacy, Product, IT and Engineering to integrate security into business and technology decisions

Requirements

Required Qualifications

10+ years of progressive experience in information security, security engineering, security operations or related disciplines
3+ years of experience leading security teams or major security programs
Demonstrated experience building, scaling or materially improving an enterprise information security program
Broad technical experience across multiple security domains including identity, endpoint, SaaS, cloud, application security, security operations and data protection
Strong understanding of security architecture, control design, incident response and risk management
Experience operating in a regulated environment and translating regulatory requirements into practical controls