Manager, Information Security

Bamboo Health is a leader in cloud-based care coordination software and analytics solutions focused on patients with complex needs, including those suffering from physical health and mental health issues and substance use disorders. We are driven by our mission of enabling better care for patients across the continuum. Our software solutions help healthcare professionals collaborate on shared patients across the spectrum of care. Join us in improving healthcare for all!  

Summary:

We are seeking a dynamic and experienced Manager of Information Security to lead the prevention, detection, and response efforts within our security ecosystem. This role will bridge strategic planning with hands-on operational execution, ensuring comprehensive security measures are in place for both our enterprise IT infrastructure and healthcare software products. 

As the Manager of Information Security, you will enhance and integrate security policies, processes, and tools while fostering a "security-first" culture across Product and Development teams. Building on the insights of our recent cybersecurity maturity assessments, you will develop and execute a strategic roadmap to achieve target security objectives. 

You will oversee key security functions, including real-time monitoring, incident response, and compliance support, while ensuring alignment with cloud security best practices. You will work closely with cross-functional leadership, including Engineering and Product teams, to ensure integration of security into our product development lifecycle. 

What You’ll Do:

• Integrate security into the SDLC and promote DevSecOps and Infrastructure-as-Code.
• Use AI and automation to improve detection, prevention, and incident response capabilities.
• Lead security incidents from detection to resolution, ensuring effective response.
• Develop and execute a 2–3-year security roadmap, focusing on continuous improvement.
• Establish and report on security KPIs through dashboards and regular updates.
• Evaluate emerging technologies, including AI, to assess cybersecurity risks and strategic opportunities while staying current on security trends and healthcare standards.
• Lead and mentor a high-performing Security Operations team, fostering growth and agility.
• Promote a culture of security awareness and continuous learning across teams.
• Manage vulnerability and application security testing processes, reporting progress regularly.
• Maintain and enhance critical security tools (SIEM, EDR, cloud monitoring, IAM).
• Collaborate with engineering to integrate security in product development and maintain secure configurations.
• Drive continuous improvement in security operations and integrate new services.
• Work with Product and Engineering teams to align security with business goals and innovation.
• Champion data integrity and confidentiality across all teams.
• Support audit and certification efforts (SOC2, HITRUST, NIST 800-53).
• Conduct access reviews and maintain documentation for security operations and compliance.

What Success Looks Like…

In 3 months…

• You will have familiarized yourself with the Bamboo Health products, organizational structure (with specific focus on the Engineering and Product teams) and establish key contacts.
• You will have familiarized yourself with key technologies, services, tools, processes, and compliance programs in use by the Information Security department.
• You will report on key metrics related to vulnerability management and incident response.
• You will participate in the on-call rotation for incident response.

In 6 months…

• You will engage with Engineering and Product teams to report, prioritize, and escalate key product-related information security risks.
• You will work with your team and with IT to continuously improve cybersecurity prevention, detection, and response capabilities including SIEM escalation rules and automations.
• Projects will be prioritized and managed to work towards continuously maturing the cybersecurity capabilities of the Information Security department.