Marathon Health is a leading advanced primary care provider, partnering with employer and union plan sponsors to improve health for millions of Americans. With nationwide onsite, nearsite, and network health centers, and virtual primary care, Marathon delivers a value-based model that enhances the healthcare experience for members and providers, while driving meaningful cost savings for plan sponsors. Marathon is proud to be certified as a Great Place to Work®, reflecting the company's commitment to building an inclusive, high-trust culture where all employees can thrive. Learn more at marathon.health ABOUT THE JOB The Manager, Information Security, is responsible for leading a team of security analysts to protect enterprise systems and PHI, ensuring compliance with HITRUST, HIPAA, SOC 2 and related regulatory frameworks while maturing detection, response, and governance capabilities. This role will handle day-to-day management of security operations and continuous compliance monitoring. The manager information security is a hands-on technical role that should be proficient in incident response, threat hunting, vulnerability management, creating automation, and integrating systems into SIEM. ESSENTIAL DUTIES & RESPONSIBILITIES Leadership & Strategy Driving cybersecurity maturity with continuous improvement of controls Continuously evaluating and managing the cyber and technology risk posture of the organization Lead Marathon Health’s internal and outsourced security teams to execute on the roadmap defined by our CISO Lead the security team response to security incidents and breaches. Lead security awareness and training programs across the organization, with tailored content for clinical staff handling PHI Technical Execution Manage the prospect, client and 3rd party security assessment fulfillment process. Identify and manage vulnerabilities Developing and implementing comprehensive risk treatment plans to protect Marathon’s assets Monitoring compliance with the information security policies Keeping up to date with IT security standards and emerging threats Maintain up-to-date knowledge of emerging technologies and services that will help Marathon maintain its technical edge and evolution Architect, prioritize, coordinate, and communicate the choice of security technologies necessary to ensure a highly secure yet frictionless computing environment Assists in the evaluation of overall risk for IT systems and the data they contain and process, accounting for the people, processes, and technologies that provide security controls Maintain and continuously improve SOC2/HITRUST CSF certification; ensure security control ownership, evidence collection, and audit readiness are operationalized across all responsible domains Manage and enforce a comprehensive information security program covering identity and access management, vulnerability management, endpoint protection, network security, incident response, and third-party risk Collaboration & Cross-Functional Delivery Work with cross-functional teams including Technology, Legal, Privacy, Finance, Internal and External Auditors to achieve corporate objectives relating to information and data security Partner with legal and compliance teams to create and support a security culture through education and awareness programs designed to reduce the risks to the enterprise while also engaging key business leaders to ensure business unit involvement Monitor compliance with HIPAA, SOC 2, state-level data privacy regulations, and contractual security requirements across all employer and health plan clients Team Development Provide technical leadership, guidance and mentoring to Security Analysts. Conduct regular performance reviews, training, and career development planning. Promote knowledge sharing and best practices across the team. QUALIFICATIONS Bachelor’s degree in computer science, information systems or cybersecurity or related field and a minimum of 2 years’ experience in people leadership within security, including serving as the final decision-maker for hiring, development, and performance management, or equivalent combination of education and experience. Experience in healthcare technology, health systems, or digital health, with working knowledge of HIPAA, PHI governance, and clinical system dependencies. Experience owning or co-owning HITRUST CSF certification (or equivalent compliance framework such as SOC 2, ISO 27001). HITRUST Certified Common Security Framework Practitioner (CCSFP) or equivalent HITRUST training One or more professional security certifications: CISSP, CISM, or CISA. AWS Security Specialty or equivalent cloud security certification CRISC (Certified in Risk and Information Systems Control) AI governance or responsible AI certifications (e.g., ISACA AI Audit certificate, Certified AI Governance Professional) Travel is required for up to 15%, team meetings, clinic visits, audit support DESIRED ATTRIBUTES Demonstrated ability to translate technical infrastructure and security concepts into business risk and value narratives for executive and board audiences Experiencing driving vulnerability management across organizations. Experience in value-based care, employer-sponsored healthcare, or population health management organizations Proven track record operating in multi-site, distributed environments; ideally 500+ locations; with complex endpoint and network management needs. Hands-on experience deploying or governing AI tools in a healthcare or clinical environment, including PHI risk controls for AI systems Experience with AIOps platforms or AI-augmented IT operations tooling Familiarity with AWS (or comparable cloud) architecture, including security posture management in cloud-native environments Pay Range: $115,000 - $145,000/yr The actual offer may vary dependent upon geographic location and the candidate’s years of experience and/or skill level. This position is also eligible for an annual incentive. We are accepting applications for this position until a candidate has been selected. To apply to this position and learn more about open jobs at Marathon Health, visit our careers page. Marathon Health is a leading advanced primary care provider, partnering with employer and union plan sponsors to improve health for millions of Americans. With nationwide onsite, nearsite, and network health centers, and virtual primary care, Marathon delivers a value-based model that enhances the healthcare experience for members and providers, while driving meaningful cost savings for plan sponsors. Marathon is proud to be certified as a Great Place to Work®, reflecting the company's commitment to building an inclusive, high-trust culture where all employees can thrive. Learn more at marathon.health Marathon Health exists to enable millions of people to live their healthiest lives, one patient at a time. If you have a passion for improving patient lives while transforming a broken U.S. healthcare, Marathon is the place for you. Marathon Health provides equal employment opportunities to all teammates and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Marathon Health is committed to providing access and reasonable accommodation in its employment for individuals with disabilities. To request disability accommodation in the application process, contact recruiting@marathon.health. Marathon Health will never ask a candidate for personal identifiable information (date of birth, social security number, driver’s license information, etc) via email or messenger tools, or for a financial deposit of any kind. All our open positions are listed here on our website and any emails sent from our teammates contain the address “@marathon.health” if you have any questions or concerns about suspicious emails or queries, please don’t hesitate to contact us directly at PeopleExperience@marathon.health. Our benefits are built around access to care that works, starting with FREE Marathon Health services for you and your family, which provides unlimited, free primary care, routine labs, select prescriptions, vaccinations, and virtual mental health care for you and your family so that our teammates can do their best work and build better healthcare Below are some of our benefit offerings. Eligibility varies based on PT or FT status: Comprehensive Health & Wellness Benefits: Choice of 2 medical plans, 2 dental plans, and vision coverage, unlimited free mental health benefits and EAP resources, Rewards for challenges and healthy lifestyle activities Family Friendly & Reproductive Health Benefits: Family-building and hormonal health benefits and paid parental leave Time-Based Benefits: Generous PTO or FTO, Paid Holidays + A Day for What Matters Financial Support: Company paid Basic Life and Disability insurance, Supplemental Life, Spending Accounts, 401(k) with employer match and graded vesting Continuing Medical Education (CME) for maintaining and strengthening the knowledge, skills, and expertise of our health center teammates, as applicable Click here to visit our Benefits page on our Careers page.