Senior Director of Information Risk & Governance

Senior Director of Information Risk & Governance (Remote – US)

Modern Health 

Modern Health is a mental health benefits platform for employers. We are the first global mental health solution to offer employees access to one-on-one, group, and self-serve digital resources for their emotional, professional, social, financial, and physical well-being needs—all within a single platform. Whether someone wants to proactively manage stress or treat depression, Modern Health guides people to the right care at the right time. We empower companies to help all their employees be the best version of themselves, and believe in meeting people wherever they are in their mental health journey.

Modern Health is backed by investors like Kleiner Perkins, Founders Fund, John Doerr, Y Combinator, and Battery Ventures and raised more than $170 million in less than two years, making Modern Health the fastest entirely female-founded company in the U.S. to reach Unicorn status.

More about our culture and what you can expect when you join the team:

• “It Takes a Village” culture. Modern Health has a unique and unabashed culture centered around high empathy and high accountability – with a drive to win. We are energized by bringing together the best talent in the industry to achieve audacious goals focused on making mental health a strength and priority for all.
• We have an obsession to win. We are highly ambitious and passionate about the work that we do.  We take pride in delivering excellence and our personal best and we continuously innovate to uniquely solve our customers’ needs.
• We are accountable and can rely on each other. We are a team and hold ourselves and each other accountable. We believe in transparent communication and continuous feedback to foster a culture of trust, reliability, and growth.
• We demonstrate empathy. We have a supportive and diverse culture where we bolster and uplift each other as we pursue our lofty goals. We encourage selflessness and a willingness to support others, fostering a collaborative and respectful environment.
• We exhibit a bias towards action. This is a fast-paced environment. We jump into problems and initiate solutions. We empower our people to make decisions and experiment, iterate, and repeat until we get it right.

Modern Health is a fully remote workforce and a hyper-growth company that is often recognized for its excellence, winning awards such as World’s Most Innovative Companies of 2023 by Fast Company, Top 25 Companies of San Francisco 2023, and 2023 Well-Being Trailblazer Award. To protect our culture and help our team stay connected, we require overlapping hours for everyone. While many roles may function from anywhere in the world—see individual job listing for more—US based team members who live outside the Pacific time zone are expected to work at least six hours between 8 am and 5 pm Pacific time each workday.

We are looking for driven, creative, and passionate individuals to join in our mission. An inclusive and diverse culture are key components of mental well-being in the workplace, and that starts with how we build our own team. If you’re excited about a role, we’d love to hear from you!

The role:

Modern Health is scaling into enterprise and regulated clients — health plans, financial services, and global employers — whose trust depends on demonstrable information technology risk governance. Much of Modern Health’s information technology risk and governance framework already exists — policies, vendor intake, access reviews, a trust center, an answer library, a risk register, incident response, and incident tooling. What this role adds is the senior ownership and oversight to establish and run our cross-functional governance programs: connecting those assets into coherent, evidenced, enterprise-credible programs, and representing our posture to strategic clients, auditors, and assessors.

The Senior Director, Information Risk & Governance is the company’s second-line-of-defense leader for information technology risk: an independent risk, governance, and assurance function reporting to the General Counsel, deliberately separated from the teams that build, operate, and execute security and IT programs. The role partners closely with the Head of Security Engineering, who continues to run operational security execution, certification readiness, audit evidence production, and day-to-day customer security response workflows. This role provides program governance, risk decision support, escalation, remediation-plan calibration, executive reporting, and client-facing support.

What you’ll do:

• Information technology risk governance. Own the information-security risk register, a leadership-approved risk appetite and tolerance model, and the exception/risk-acceptance register. Drive cross-functionally ratified decision rights (RACI) for risk acceptance, questionnaires, incidents, vendor exceptions, and contractual security commitments. Deliver the monthly executive information-risk report and periodic board reporting, and own the information-risk and AI-risk workstream of the enterprise Risk Committee (chaired by the Compliance & Privacy Officer).
• Risk-balanced business prioritization. Coordinate and facilitate the balance between risk and business imperative, in partnership with business functions: prioritize security reviews, resourcing, and remediation by business need and revenue impact; frame risk decisions as tradeoffs with recommendations; and embed security engagement points early in enterprise deals, product launches, and AI initiatives so risk work accelerates the business rather than gates it.
• AI governance program operations. Run the cross-functional AI governance program built with the Compliance & Privacy Officer, who retains AI policy content and legal counsel: committee operations, intake (GAT) at enterprise scale, approved/restricted-use administration, AI vendor eligibility and BAA/DPA-chain requirements, coding-agent governance, product AI review gates, AI incident management, and customer-facing AI governance evidence.
• Incident management program. Own incident management as an enterprise program: unified severity thresholds, playbooks by incident type (security, privacy, provider/clinical, vendor), tabletop exercises, escalation paths and leadership notification standards, and post-incident corrective action tracking. Commands cross-functional non-technical incidents. Security engineering serves as technical incident commander for cyber incidents; the Compliance & Privacy Officer retains investigations program, privacy breach determinations and regulator/individual notification decisions.
• Data governance (security side). Drive management of the data retention and deletion program, the data classification program, and data hosting/residency positions — and lead the data segregation program (PHI data map → designated record set (DSR) into the EMR → segregation of non-DRS PHI) as a critical-path priority that gates AI capability and shrinks the certification boundary. Partner with Security Engineering, IT, and Data on implementation and with the privacy team on privacy positions. Stand up the data governance decision forum.
• Certification & assurance programs. Provide second-line governance, program assistance, and risk escalation support for Modern Health’s certification and assurance programs, including HITRUST, SOC 2, ISO 27001 readiness, and third-party HIPAA risk assessments. The Head of Security Engineering owns day-to-day program execution, control operation, evidence production, auditor walkthrough support, and remediation execution. This role partners with the Head of Security Engineering on certification strategy, scope, prioritization, risk decisions, findings, remediation plans, exception requests, executive visibility, and customer-facing assurance positions.
• Third-party risk. Own the overall vendor risk program and risk-tiered assessment framework. Set minimum review standards, risk-tiering rules, approval and exception paths, escalation criteria, reassessment cadence, remediation expectations, and customer-commitment alignment. Ensure Modern Health is consistently assessing vendors against the right risks, applying the right level of review, and escalating material vendor risk decisions through the appropriate governance path.
• Customer trust & enterprise assurance. Provide second-line review and risk calibration for customer security questionnaires, RFP security responses, trust-center materials, standard assurance packages, audit-right responses, and client-facing security commitments. Security owns the day-to-day response process, answer-library content, technical inputs, and evidence production. This role reviews higher-risk responses and non-standard positions, helps calibrate commitments against Modern Health’s actual control environment and risk appetite, and interfaces directly with strategic customer information-risk and security teams.
• Policy & awareness (information risk). Own the information security and risk policy suite (Vanta-managed), annual review cycle, and risk awareness content — coordinated with, not duplicative of, the compliance training program.

Who you are/ Requirements:

• 10+ years in information-security risk management, security governance, assurance, GRC, or security program leadership, with 5+ years in a regulated, PHI-handling environment.
• Digital health, health plan, or healthcare services experience strongly preferred.
• Experience providing senior governance, oversight, or program leadership for SOC 2, HITRUST, HIPAA Security risk assessments, ISO 27001 readiness, or comparable security assurance frameworks. Direct execution experience is valuable, but this role requires the judgment to guide scope, findings, remediation plans, evidence strategy, and risk escalation in partnership with Security.
• Deep working knowledge of HIPAA Security Rule, NIST CSF 2.0, SOC 2, HITRUST, third-party risk frameworks, and customer security assurance expectations. Familiarity with NIST AI RMF and emerging AI governance expectations preferred.
• Strong risk-decision judgment: able to distinguish technical control gaps from material enterprise risk, calibrate remediation plans against customer commitments and business priorities, and recommend when risk should be accepted, mitigated, escalated, or deferred.
• Experience partnering with Security, IT, Legal, Privacy, Compliance, Sales, Procurement, and Product teams to translate technical issues into business-ready decisions, executive reporting, customer commitments, and audit-ready evidence.
• Customer-facing credibility: comfortable engaging with strategic customer CISOs, security review teams, procurement risk teams, auditors, and assessors, especially when responses require risk calibration or senior escalation.
• Experience with third-party security risk programs, including vendor risk tiering, assessment standards, exception paths, remediation expectations, and alignment between vendor commitments and customer obligations.
• Experience with incident management program governance, including severity thresholds, escalation paths, playbook design, tabletop facilitation, corrective action tracking, and coordination with Legal and Privacy on notification-related decision points.
• Executive communication: translates technical risk, certification status, vendor risk, and customer assurance issues into concise, decision-ready business terms for executive team and board audiences.
• Builder-integrator profile: able to take existing distributed processes, including security tickets, vendor intake, trust-center content, answer libraries, risk registers, audit evidence, and policy suites, and turn them into coherent, evidenced, repeatable programs.
• Relevant certifications preferred: CISM, CRISC, CISSP, CISA, CIPP/US, HITRUST CCSFP, or similar.
• Immigration sponsorship is not available for this position. Applicants must be able to maintain work authorization for the duration of employment without employer sponsorship or employer-provided training plans or attestations (including, for example, the Form I-983 required for STEM OPT).

Benefits

Fundamentals:

• Medical / Dental / Vision / Disability / Life Insurance
• High Deductible Health Plan with Health Savings Account (HSA) option
• Flexible Spending Account (FSA)
• Access to coaches and therapists through Modern Health’s platform
• Generous Time Off
• Company-wide Collective Pause Days

Family Support:

• Parental Leave Policy
• Family Forming Benefit through Carrot
• Family Assistance Benefit through UrbanSitter

Professional Development:

• Professional Development Stipend

Financial Wellness:

• 401k
• Financial Planning Benefit through Origin

But wait there’s more…!

• Annual Wellness Stipend to use on items that promote your overall well being
• New Hire Stipend to help cover work-from-home setup costs
• ModSquad Community: Virtual events like active ERGs, holiday themed activities, team-building events and more
• Monthly Cell Phone Reimbursement