VP, Information Security

• Fantastic health and wellness benefits package, including an outstanding 401k match, a flexible PTO program, and a generous and inclusive parental leave policy. Additionally, Relias pays for the employee portion of the monthly healthcare premium!
• Flexible work environment with onsite and work from home options - you choose when you want to come into the office!
• Active Employee Resource Groups open to all employees!
• Comprehensive onboarding program - a great introduction to our company, customers and culture!
• Growth and career advancement opportunities!

• 20%+ annual employee promotion and transfer rate
• Multiple development program options - leadership development, professional development curriculums, and Nanodegree options in both technology and data science
• Professional development gained from conference attendance and participation in organizations like NC Tech
• Onsite 321 Coffee Shop providing free coffee and pastries to employees

• Strategy & Information Security Management System ISMS: Setting the multi-year security strategy and run the Bertelsmann ISMS: risk assessment / management, policy framework, KPIs/KRIs, and management reviews with the divisional team (at least quarterly).
• Governance & Compliance: Delivering and sustaining ISO/IEC 27001, SOC 2 Type II, HIPAA, GDPR; map/advance FedRAMP/HITRUST and other frameworks.
• Security Operations & IR: Mature SOC; driving continuous reduction in MTTD/MTTR; overseeing incident reporting obligations across the security organization.
• Security by Design (with Engineering, IT & Ops): Co-owning secure-by-default standards and embedding them across products and core processes-threat modeling, SAST/DAST/SCA, secrets/vaulting, SBOM, and container/K8s hardening-driving measurable reductions in defect escape and time-to-remediate.
• Enterprise/Cloud Security: Advancing Zero Trust identity, endpoint, network segmentation; hardening AWS/Azure (CSPM/CIEM), data protection & key management
• AI Governance & Privacy: Actively participating in the AI Governance Committee; ensuring compliance with group AI thresholds, and partnering with Data Protection on privacy-by-design.
• GRC/Trust Enablement: Scaling the customer trust program (security questionnaires, artifacts, CAIQ/SIG), supporting enterprise deals, and briefing customers as exec sponsor.
• People & Culture: Building and retaining a high-performing team across GRC, AppSec, CloudSec, and SecOps; growing a security champions network and role-based training.
• Exec Communication: Translating risk to financial impact and ROI; briefing CFO/Division on posture, roadmap, and investment trade-offs.
• Partnering with engineering and operations teams to embed security by design into all products and processes.
• Ownership of Relias reporting to the Bertelsmann ISMS: risk assessment/management, quarterly (at least) management reviews with the divisional team, and incident reporting across the security organization.

• 12+ years in information security with meaningful time leading across GRC, AppSec, CloudSec, and SecOps in cloud-native SaaS.
• Proven success running an ISMS (ISO 27001) and delivering SOC 2 Type II; HIPAA/GDPR fluency; FedRAMP/HITRUST.
• Bachelor's degree in information security or equivalent experience in Information Security
• Executive presence and crisp communication-able to turn technical risk into business decisions and defend prioritization with data.
• Experience building teams, operating incident command, partnering with Legal, IT, Engineering, and Internal Audit.
• Knowledge of security and compliance frameworks (NIST, ISO 27001, SOC 2 (Trust Services Criteria), etc)
• Analytical and troubleshooting of issues and needs
• Strong technical background and the ability to discuss security topics at an architectural level
• Communication and presentation skills (written and oral)
• Leadership, teamwork and conflict management
• Highly adaptable to constantly changing business and technology environments

• Certified Information Systems Security Professional (CISSP) - Strongly preferred
• Certified Information Security Manager (CISM)
• Certified Cloud Security Professional (CCSP)
• Systems Security Certified Practitioner (SSCP)
• Healthcare Information Security and Privacy Practitioner (HCISPP)

• "route" is used for session stickiness
• "careerSiteCompanyId" is used to send the request to the correct data center
• "JSESSIONID" is placed on the visitor's device during the session so the server can identify the visitor
• "Load balancer cookie" (actual cookie name may vary) prevents a visitor from bouncing from one instance to another

Penguin Random House