Senior Manager, IT Security

Job Description Summary

‎

‎

How will you make an impact & Requirements

‎

Who We Are:

At Castlight, we’re making it as simple as humanly possible for people to navigate the complicated, often frustrating, world of healthcare. We partner with America’s largest employers and health plans, transforming employee benefits into a deeply personalized and guided journey for millions of users. What we build genuinely helps people live happier and healthier lives.

What You'll Do:

Reporting directly to the Head of Technology, you will lead Castlight's dedicated security organization while driving customer-facing security trust and hands-on technical execution. Operating as a true player-coach, you will balance team leadership and strategic governance, direct technical and architectural execution, and client enablement and support.

In this role, you will:

• Lead & Elevate the Security Team: Lead, coach, and support a dedicated team across SecOps, AppSec, CloudSec, and GRC—setting clear technical expectations, removing operational roadblocks, and fostering a culture of high agency and accountability.
• Drive Security Operations & Automation: Oversee SecOps capabilities, including security automation (SOAR), infrastructure hardening, vulnerability management, and patch management coordination to strengthen the organization's overall security posture.
• Champion Client Support & Sales Enablement: Partner with commercial, legal, and sales leadership to represent Castlight's security posture to prospective and current customers. Address security provisions in contracts, guide technical responses for complex RFPs, and lead security defense calls with client CISOs and risk teams.
• Lead Customer Incident Communications: Serve as the primary, trusted technical bridge to customers when security issues or critical vulnerabilities arise—translating technical remediation into executive-ready communication alongside our CISO and Engineering leadership.
• Execute Hands-on in AppSec & Cloud Security: Dive into technical reviews, guide AppSec standards across GitHub Actions and deployment pipelines, and shape secure cloud infrastructure patterns on Google Cloud Platform (GCP).
• Support Auditability & Maintain Framework Standards: Partner closely with our internal audit team by embedding robust controls across engineering workflows, ensuring our technical architecture and operations continuously align with SOC 2, HITRUST, and NIST standards.
• Drive Cohesive Incident Escalation & Response: Oversee vulnerability management and incident response escalations, coordinating closely with enterprise cyber operations to ensure swift containment, remediation, and recovery from emerging threats.
• Establish Security Operations Metrics: Define and track key SecOps KPIs, including vulnerability remediation timelines, patch compliance, and security configuration drift, to measure operational effectiveness and drive continuous improvement.

Skills & Qualifications:

• Leadership Experience: 7+ years of progressive information security experience, including demonstrated success leading, coaching, and mentoring technical security engineers in a player-coach capacity.
• Client-Facing Acumen: Proven capability to interact directly with enterprise customer security leaders, procurement specialists, and health plan CISOs. Experience reviewing security contract terms, supporting enterprise RFPs, and articulating complex security postures to external stakeholders.
• Technical AppSec & Cloud Depth: Hands-on experience with Application Security (DAST, secure SDLC, CI/CD pipeline controls) and Cloud Security architecture, with an emphasis on Cloud Platform (We run GCP - but any cloud platform is sufficient) and containerized/microservice ecosystems.
• Security Framework Familiarity: Working knowledge of SOC 2, HITRUST, and NIST frameworks, with a track record of implementing technical controls and supporting auditability.
• Crisis Management & Communication: Exceptional communication and presentation skills, with the ability to maintain composure during security incidents and clearly explain root cause, blast radius, and remediation roadmaps to client leadership.
• Cross-Functional Collaboration: Demonstrated ability to partner effectively with Engineering, Product, Legal, and executive leadership, balancing defense-in-depth with business momentum.

‎

Compensation Range:

to

The anticipated base salary range represents the Company's good-faith estimate of the compensation it reasonably expects to pay for this position at the time of posting. Actual compensation will be determined based on factors including experience, skills, qualifications, geographic location, internal equity, and business needs.

Disclaimer

Beware of fraudulent job postings: While Mosaic Health job advertisements may be found on many sites, our current openings page and its associated Workday account are the only places we accept applications for open roles. If you suspect a job post is fraudulent, please let us know at recruiting@apree.health.

About Us

Mosaic Health is a national care delivery platform focused on expanding access to comprehensive primary care for consumers with coverage across Commercial, Individual Exchange, Medicare, and Medicaid health plans.

Learn More about Mosaic Health