Director of Cybersecurity & Compliance

About the Role

We are seeking an experienced Director of Cybersecurity & Compliance to lead the protection of our digital infrastructure, patient-facing platforms, and highly sensitive behavioral health information.

This leader will oversee enterprise cybersecurity strategy, cloud security governance, risk management, and regulatory compliance across a multi-state behavioral healthcare environment. The Director will partner closely with Technology, Clinical, Operations, executive leadership, and the Chief Compliance and Privacy Officer to ensure our systems, patient information, and business operations remain secure, scalable, resilient, and compliant.

Key Responsibilities

Cybersecurity Strategy & Governance

• Develop and execute a company-wide cybersecurity strategy designed to protect highly sensitive behavioral health information, patient-facing platforms, provider systems, and virtual care environments.
• Architect and maintain the security and compliance roadmap across AWS, Microsoft Azure, and Microsoft 365 environments.
• Develop, maintain, and continuously improve cybersecurity policies, standards, and governance documentation, including Incident Response Plans, Breach Notification procedures, System Security Plans (SSPs), and related security and compliance documentation.
• Establish and report meaningful cybersecurity metrics and key risk indicators (KRIs), including risk trends, remediation progress, security posture, and compliance readiness.
• Translate complex cybersecurity, cloud, and compliance risks into clear, actionable business recommendations for executive leadership and board-level stakeholders, as appropriate.

Healthcare Compliance & Risk Management

• Lead cybersecurity compliance efforts related to HIPAA, HITECH, SOC 2, HITRUST, NIST, and other applicable federal and state healthcare privacy and security requirements.
• Ensure cybersecurity and compliance practices appropriately support the organization's multi-state healthcare operations, including applicable state-specific healthcare privacy and security requirements.
• Maintain appropriate safeguards for sensitive behavioral health information, including patient records, psychotherapy-related information, intake documentation, provider information, and other protected health information.
• Conduct or manage HIPAA Security Rule risk analyses, including asset identification and inventory, business associate management, Business Associate Agreements (BAAs), risk assessment, remediation, and ongoing monitoring.
• Maintain the enterprise cloud/IT risk registry and oversee risk identification, prioritization, remediation, and reporting.
• Lead and coordinate external cybersecurity and compliance audits and maintain ongoing organizational audit readiness.
• Ensure applicable security policies and controls are appropriately mapped to regulatory and compliance requirements.

Cloud & Data Security

• Provide cybersecurity governance across Amazon Web Services (AWS), Microsoft Azure, and Microsoft 365 environments.
• Implement and oversee identity and access management (IAM), encryption, data loss prevention (DLP), configuration controls, and other safeguards protecting sensitive patient, provider, and organizational information.
• Ensure appropriate security controls are maintained across psychiatric EHR systems, patient portals, intake systems, provider platforms, telehealth environments, and other patient-facing applications.
• Leverage cloud-native technologies such as AWS Audit Manager and Microsoft Purview to support continuous compliance and move beyond point-in-time audit readiness.
• Monitor cloud configurations, access controls, DLP controls, and IAM policy enforcement to identify and remediate security risks.

Security Operations & Incident Response

• Oversee regular vulnerability assessments, security monitoring, and threat identification across networks, cloud environments, provider portals, and patient-facing applications.
• Lead organizational response to cybersecurity incidents, data breaches, unauthorized access, and other security events.
• Manage applicable healthcare breach reporting and notification workflows in coordination with appropriate internal and external stakeholders.
• Develop and coordinate cybersecurity incident tabletop exercises to evaluate organizational preparedness and identify opportunities for improvement.
• Ensure lessons learned from incidents and exercises are incorporated into security policies, procedures, training, and controls.

Business Continuity & Disaster Recovery

• Partner with Technology, Operations, Clinical, and other appropriate stakeholders to support business continuity and disaster recovery planning.
• Ensure cybersecurity risks and dependencies are appropriately incorporated into organizational continuity and recovery strategies.
• Participate in testing and evaluation of recovery preparedness for critical systems and sensitive healthcare information.

Third-Party & Vendor Risk Management

• Lead cybersecurity and compliance assessments of third-party vendors, software platforms, business partners, and other external systems that access, process, transmit, or store sensitive organizational or healthcare information.
• Evaluate internal and third-party software and services to ensure appropriate security controls are implemented and maintained.
• Partner with appropriate stakeholders to support vendor security due diligence, remediation, and ongoing monitoring.
• Identify and communicate material third-party cybersecurity risks to appropriate business and executive stakeholders.

Leadership, Education & Cross-Functional Partnership

• Lead, mentor, and support the professional development of cybersecurity, GRC, and IT team members.
• Develop and support cybersecurity education and awareness initiatives for psychiatric clinicians, administrative employees, technical teams, and other workforce populations.
• Partner closely with Technology, Clinical, Operations, and other business functions to align organizational goals with appropriate cybersecurity controls and risk-management practices.
• Serve as a trusted cybersecurity and compliance advisor to executive leadership.
• Foster a culture of security awareness, accountability, and continuous improvement across the organization.
• Work closely with the Chief Compliance and Privacy Officer to align cybersecurity and data security practices with organizational privacy, compliance, and regulatory requirements.

Required Qualifications

• 8 years of progressive experience in cybersecurity, IT audit, corporate cloud risk management, GRC, or a related discipline.
• Billingual spanish/English preferred.
• 3 years of leadership experience, preferably within behavioral health, telehealth, healthcare IT, healthcare, or another highly regulated environment.
• Strong knowledge of HIPAA/HITECH requirements and applicable federal and state healthcare privacy and security requirements, with demonstrated ability to support multi-state healthcare operations.
• Demonstrated experience conducting or managing HIPAA Security Rule risk analyses, including asset identification and inventory, business associate management, BAAs, risk assessment, remediation, and ongoing monitoring.
• Deep multi-cloud expertise, specifically securing, governing, or auditing AWS and Microsoft Azure/M365 environments.
• 5 years of hands-on experience with AWS and Microsoft Azure/M365 ecosystems.
• Strong working knowledge of cybersecurity and compliance frameworks, including NIST, SOC 2, HITRUST, and ISO 27001, as applicable to the organization's environment.
• 5 years of experience participating in or leading healthcare security/compliance audits and assessments, including SOC 2 and HIPAA Security Rule risk analyses.
• Strong understanding of identity and access management, encryption, DLP, vulnerability management, incident response, cloud security governance, and enterprise risk management.
• Experience leading external auditors and complex cross-functional cybersecurity or compliance initiatives through successful outcomes.
• Experience evaluating cybersecurity and compliance risks associated with vendors and third-party technology platforms.
• Demonstrated ability to partner effectively with engineering, technology, clinical, operations, and business teams while aligning business objectives with appropriate security controls.
• Strong written and verbal communication skills, including demonstrated ability to translate complex cybersecurity and compliance risks for executive and non-technical audiences.
• Fluent spoken English.

Preferred Qualifications

• Industry certification such as CISSP, CISM, CRISC, CISA, or a comparable cybersecurity/risk certification.
• Cloud-specific credentials such as AWS Certified Security – Specialty, Microsoft Azure Security Engineer Associate, or comparable certification.
• 3 years of hands-on experience with continuous compliance technologies such as Microsoft Purview and AWS Audit Manager.
• Direct cybersecurity/compliance experience within behavioral health, mental health, telehealth, or healthcare technology.
• Experience mentoring and developing cybersecurity, GRC, or IT professionals.

Compensation

The anticipated base salary range for this Houston-based position is $150,000–$180,000 annually. Final compensation will be determined based on relevant experience, qualifications, certifications, and alignment with the scope of the position.