Manager of Security & IT

Location: United States

Department: Infrastructure & Security

Location Type: REMOTE

Employment Type: FULL_TIME

About the Role

What You'll Do

• Lead Fabric's security program across application security, security operations, identity and access management, endpoint security, cloud security, and vendor security.
• Own incident response end-to-end, covering detection, triage, response, post-mortems, and the structural improvements that follow.
• Lead customer security questionnaire responses and vendor security reviews, acting as a credible authority who can speak to a CISO at a health system and earn their trust.
• Set security policies and standards that engineering, product, and operations can practically follow.
• Represent security in executive conversations about risk, investment, and technical tradeoffs.

• Own corporate IT operations, including the identity platform (Okta or equivalent), MDM, endpoint management, helpdesk, hardware, and SaaS provisioning.
• Build and deploy custom AI tools, agents, and automated workflows to scale IT and security operations, moving beyond standard vendor defaults.

• Manage and mentor a team of three direct reports, helping them grow their careers and empowering them to integrate AI into their daily workflows.
• Partner with the owner of our compliance program to feed evidence, implement controls, and operationalize SOC2, HITRUST, and HIPAA requirements without bottlenecking either side.

Why You Might Be a Good Fit

• You bring seasoned security expertise, combining proven leadership experience with an extensive, hands-on background across security operations.
• You have actually run corporate IT, not just had it report to you. You know what good identity hygiene looks like, you have debugged endpoint issues yourself, and you have handled an offboarding crisis at 9 p.m.
• You can do both: set the program and do the work. This is not a delegate-everything role at this stage.
• You think identity-first. Most security failures route through identity, and you build defenses with that as the starting assumption.
• You have worked in healthcare or another regulated industry where the rules genuinely matter and audits are part of the rhythm.
• You can talk to engineers without losing them and to executives without confusing them.
• You are a passionate AI practitioner who has proven experience building custom AI workflows, agents, and automation tools to solve complex security and IT challenges.

This Might Not Be The Right Fit If...

• You want a pure CISO seat where you set policy and someone else implements. We are too early for a delegate-everything role.
• You have not actually run corporate IT before. Reporting to you is not the same as having done the work.
• You are uncomfortable being the security and IT person. This is a dual-hat role and stays that way until we are larger.
• You need a fully built program. We have foundations but not maturity; you will be building.
• You prefer strictly out-of-the-box vendor configurations over engineering custom AI-driven automation.

Your Qualifications

• 7+ years of security experience with at least 2 years in a security leadership or management role.
• Direct experience managing corporate IT operations, including identity, endpoint, MDM, SaaS provisioning, and the helpdesk.
• Proven application security or cloud security background. You will partner closely with our Application Security Engineer and must possess the technical depth to lead them, not just manage them.
• Experience operating in a healthcare or highly regulated industry environment handling PHI under HIPAA.
• Working knowledge of SOC2 and HIPAA frameworks, with HITRUST familiarity as a plus.
• Management experience overseeing 1 to 3 direct reports, ideally including building a function from a small base and actively guiding career development.
• Proven track record of building and deploying custom AI tools, agents, or automated workflows to streamline IT and security operations.

Bonus Points

• Hands-on experience with Okta or another modern IAM/SSO platform.
• AWS or GCP cloud security depth.
• Prior incident response leadership at a healthcare or regulated company.
• HITRUST or NIST 800-66 specific familiarity.
• Experience working with external auditors and assessors.

The national pay range for this role is $160,000.00 – $180,000.00 per year. Actual compensation will be determined by factors such as the candidate's geographic market, experience, skills, and qualifications. Certain roles may also be eligible for additional compensation, including a comprehensive benefits package such as medical, dental, vision, unlimited PTO, and a 401(k) plan, stock options and bonuses. If your compensation requirement is greater than our posted range, please still consider applying; a determination can be made based on unique qualifications. Expected compensation ranges for this role may change over time.