Fractional CISO / CSO (Remote)
Handl Health is a post-Series A healthcare technology company building AI-powered care navigation and cost estimation products. We handle PHI and operate under HIPAA, and we’re scaling fast — which means our security and compliance posture needs to scale with us.
We’re looking for a fractional CSO to take full ownership of our security program. Today, security is carried by our Head of Engineering alongside everything else. We need a dedicated leader who can establish the frameworks, policies, and operational practices that let us move fast without accumulating risk.
This is a hands-on leadership role, not an advisory engagement. You’ll own outcomes, not just recommendations.
• Please note:
• This is a fractional / part-time role expected for up to 20-hours per week for an initial 6-month contract
• We are moving quickly on this search. Selected applicants should be available to interview promptly and, if selected, onboard quickly.
• *What You’ll Do**
• Own the end-to-end security posture including HIPAA compliance, SOC 2, and vendor risk management
• Conduct a security assessment of our current infrastructure (AWS, S3 data lake, AI integrations) and build a prioritized remediation roadmap
• Establish and maintain security policies, incident response procedures, and access control frameworks
• Evaluate and manage risk across our AI toolchain including Claude Enterprise, MCP integrations, and third-party connectors (Slack, Gmail, Google Drive)
• Own DLP strategy for our data lake, including PHI quarantine architecture and access controls
• Manage our JAMF instance and endpoint security across the organization
• Lead security reviews for new product features and AI capabilities before they ship
• Interface with customers and partners on security questionnaires, audits, and compliance requirements
• Build the security culture — training, awareness, and lightweight processes that engineers actually follow
• *What You Bring**
• 10+ years in information security with at least 3 years in a CISO or senior security leadership role
• Deep HIPAA experience — you’ve built or led compliance programs for companies handling PHI
• Hands-on knowledge of AWS security (IAM, S3 policies, Lake Formation, CloudTrail, GuardDuty)
• Hands-on experience securing AI/ML systems — you’ve evaluated prompt injection, data exfiltration, model safety, and supply chain risks in LLM-based architectures and can build policy around them
• Track record of building security programs at startups or growth-stage companies, not just maintaining them at large enterprises
• Comfortable operating as a fractional executive — you know how to prioritize ruthlessly and drive outcomes with limited hours
• ***Nice to Have****
• SOC 2 Type II audit experience
• Familiarity with healthcare payer or TPA ecosystems
• Background in securing API products and B2B data integrations
• ***Why Handl Health****
• High-impact role where your work directly protects patients’ data and enables the company to scale confidently
• Work alongside a technical leadership team that understands security and won’t fight you on doing the right thing
• Post-Series A company with the resources to invest in security properly
• Flexible fractional engagement designed to respect your time and maximize your impact
Apply tot his job
Apply To this Job
We’re looking for a fractional CSO to take full ownership of our security program. Today, security is carried by our Head of Engineering alongside everything else. We need a dedicated leader who can establish the frameworks, policies, and operational practices that let us move fast without accumulating risk.
This is a hands-on leadership role, not an advisory engagement. You’ll own outcomes, not just recommendations.
• Please note:
• This is a fractional / part-time role expected for up to 20-hours per week for an initial 6-month contract
• We are moving quickly on this search. Selected applicants should be available to interview promptly and, if selected, onboard quickly.
• *What You’ll Do**
• Own the end-to-end security posture including HIPAA compliance, SOC 2, and vendor risk management
• Conduct a security assessment of our current infrastructure (AWS, S3 data lake, AI integrations) and build a prioritized remediation roadmap
• Establish and maintain security policies, incident response procedures, and access control frameworks
• Evaluate and manage risk across our AI toolchain including Claude Enterprise, MCP integrations, and third-party connectors (Slack, Gmail, Google Drive)
• Own DLP strategy for our data lake, including PHI quarantine architecture and access controls
• Manage our JAMF instance and endpoint security across the organization
• Lead security reviews for new product features and AI capabilities before they ship
• Interface with customers and partners on security questionnaires, audits, and compliance requirements
• Build the security culture — training, awareness, and lightweight processes that engineers actually follow
• *What You Bring**
• 10+ years in information security with at least 3 years in a CISO or senior security leadership role
• Deep HIPAA experience — you’ve built or led compliance programs for companies handling PHI
• Hands-on knowledge of AWS security (IAM, S3 policies, Lake Formation, CloudTrail, GuardDuty)
• Hands-on experience securing AI/ML systems — you’ve evaluated prompt injection, data exfiltration, model safety, and supply chain risks in LLM-based architectures and can build policy around them
• Track record of building security programs at startups or growth-stage companies, not just maintaining them at large enterprises
• Comfortable operating as a fractional executive — you know how to prioritize ruthlessly and drive outcomes with limited hours
• ***Nice to Have****
• SOC 2 Type II audit experience
• Familiarity with healthcare payer or TPA ecosystems
• Background in securing API products and B2B data integrations
• ***Why Handl Health****
• High-impact role where your work directly protects patients’ data and enables the company to scale confidently
• Work alongside a technical leadership team that understands security and won’t fight you on doing the right thing
• Post-Series A company with the resources to invest in security properly
• Flexible fractional engagement designed to respect your time and maximize your impact
Apply tot his job
Apply To this Job