Director, Information Security

Connexure is a software company serving the self-funded medical benefits ecosystem. Our software helps stop loss carriers, brokers, and third-party administrators with quoting, underwriting, and administering stop loss policies. Our mission is to unify the self-funded medical ecosystem through integrated technologies, processes, and data insights. We are looking for talented and motivated individuals who align with our vision and will support the next phase of growth. DIRECTOR OF INFORMATION SECURITY As Director of Information Security (CISO), you will own Connexure's security program end to end — from policy and framework governance, through tooling strategy across endpoint and cloud, to how we respond to client security due-diligence and emerging AI risk. Reporting to the CTO, you will directly manage our Security Analyst, who owns day-to-day threat monitoring and the annual activities required to maintain our SOC 2 and HITRUST certifications. You will build the strategic and architectural layer that sits above that day-to-day work: setting the policies, choosing the tools, and making the judgment calls that keep a small, fast-moving software company secure in a highly regulated space. Reports to: CTO FLSA Exemption: Exempt Position Location: Atlanta, GA PRIMARY RESPONSIBILITIES Security Strategy, Policy & Governance Own Connexure's information security strategy, policies, and control framework end to end — writing, maintaining, and enforcing policies that hold up under SOC 2 and HITRUST audit and reflect how the company actually operates. Select and maintain an internal control framework to organize the security program (for example, aligning to a recognized baseline such as NIST CSF or ISO 27001) so controls map cleanly across SOC 2, HITRUST, and client contractual requirements. Maintain the risk register and drive remediation of identified gaps to closure, not just to “logged.” Security Architecture & Tooling Own the security tooling roadmap end to end — endpoint protection, cloud security posture, identity and access management, network monitoring (including oversight of Darktrace, CrowdStrike, and related tools currently run by the Security Analyst), and email/collaboration security. Evaluate, select, and manage vendor relationships for security tooling, balancing coverage against cost and operational overhead appropriate for a small engineering organization. Partner with Engineering leadership on secure-by-design practices in the product development lifecycle. Compliance & Certification Oversight Serve as the executive owner of the SOC 2 Type II and HITRUST certification programs, setting audit strategy and serving as primary point of contact for auditors and assessors. Direct and develop the Security Analyst, who executes day-to-day compliance monitoring, evidence collection, and control testing. Ensure certifications are maintained continuously, not rebuilt each audit cycle. …