Chief Information Security Officer (CISO) / Directeur de la sécurité de l'information
Insurity · Canada · remote
Please note that Insurity will only reach out to interview, make an offer of employment, or conduct onboarding activities for candidates who have applied through our careers site. When interviewing for a position, the candidate experience will include live interaction, such as a video or telephone call, with a Recruiter and/or company employee(s). We will never ask for any money or payments from applicants at any point in the recruitment process. Recruiters will only reach out from an insurity.com email address; no other email addresses will be used. Examples of fraudulent email addresses that have been used end with @insurityjobs.us. Be aware of suspicious recruitment activity. If you think you are a victim of an employment scam, you may contact your local law enforcement agency and/or visit the Federal Trade Commission website here: https://consumer.ftc.gov/articles/job-scams.
Who We Are
Insurity empowers insurance organizations to quickly capitalize on new opportunities by delivering the world’s most configurable, cloud-native, easy-to-use, and intuitively analytical insurance software. Just as importantly, we empower our people—providing the tools, support, and opportunities they need to grow and succeed.
We don’t just make bold promises—we deliver results. As the largest cloud-based software provider for the Property & Casualty market, Insurity is trusted by 22 of the top 25 P&C carriers and 7 of the top 10 wholesale brokers in the MGA space. Behind that trust is a team that delivers exceptional value and deep industry expertise.
While our technology sets us apart, it’s our people who truly make the difference. At Insurity, you’ll collaborate with some of the most creative and knowledgeable minds in insurance tech—in a culture that fosters innovation, teamwork, and continuous learning. Our award-winning onboarding experience welcomes and supports you from the moment you accept our offer.
Ready to grow your career with an industry leader? Apply today—we’re excited to welcome you. #UatInsurity
Insurity’s Next Chief Information Security Officer (CISO)
Insurity is seeking a strategic, operational, and technically credible Chief Information Security Officer to lead Insurity’s enterprise security, cybersecurity risk and privacy programs.
The CISO will protect Insurity’s information assets, products, customer environments, and technology ecosystem while enabling growth, cloud adoption, international expansion, and responsible use of artificial intelligence. This leader will translate cybersecurity, privacy, compliance, and technology risk into clear business decisions for executive leadership and the Board.
The successful candidate will combine executive presence with practical execution. They need to be comfortable setting strategy, leading through influence, engaging with customers executives and regulators, directing major incidents, reviewing architecture, and building the processes, team, and culture required for a growing SaaS company.
What Our Chief Information Security Officer (CISO) Will Do
Enterprise security strategy and governance
- Develop, implement, and continuously improve Insurity’s enterprise information security strategy, policies, standards, and control framework.
- Establish security priorities that align with business strategy, product roadmaps, customer commitments, and the organization’s risk appetite.
- Reinforce an enterprise security governance structure, including executive steering forums and appropriate reporting to the executive team and Board of Directors.
- Define clear accountability for security across Engineering, Product, Corporate IT, Cloud Operations, Legal, Privacy, and Compliance business functions.
- Provide risk-mitigating direction for initiatives with technology, data, cloud, product, or customer-security implications.
- Maintain a forward-looking view of emerging threats, technologies, regulations, and business risks.
HIPAA, PHI data protection
- Own and mature Insurity’s HIPAA compliance and electronic protected health information program where applicable to Insurity’s products, services, customers, vendors, and business operations.
- Lead documented HIPAA risk analyses, risk treatment plans, control testing, remediation tracking, and periodic program evaluations.
- Ensure appropriate administrative, physical, and technical safeguards for protected health information, including access control, authentication, audit controls, integrity, transmission security, encryption, contingency planning, and workforce security.
- Partner with Legal, Privacy, Compliance, Product, and Customer Success on the HIPAA Privacy, Security, and Breach Notification Rules.
- Establish requirements for Business Associate Agreements, customer obligations, subcontractors, cloud providers, and other third parties that create, receive, maintain, or transmit PHI.
- Maintain audit-ready evidence and support customer diligence, independent assessments, regulatory inquiries, and OCR requests.
- Lead the security component of PHI breach assessment, containment, investigation, notification coordination, and post-incident remediation.
- Ensure HIPAA-specific workforce training, sanctions, and awareness requirements are incorporated into the broader security program.
AI security, governance, and responsible adoption
- Establish and lead Insurity’s enterprise AI security and governance program.
- Maintain an inventory of AI, machine learning, large language model, generative AI, and agentic systems used, developed, procured, or embedded in Insurity products and operations.
- Define AI intake, risk classification, ownership, approval gates, prohibited uses, and human-oversight requirements.
- Establish secure-use standards for generative AI, including requirements for confidential information, PHI, PII, customer data, source code, proprietary data, prompts, outputs, retention, and model training.
- Define controls for AI-specific risks, including prompt injection, data leakage, insecure agents and tools, model abuse, data poisoning, supply-chain risk, unauthorized access, and unreliable or harmful outputs.
- Partner with Legal, Privacy, Product, Engineering, Data, and Compliance to address transparency, intellectual property & data rights of emerging AI regulations.
- Incorporate AI security and governance requirements into procurement, third-party risk management, secure development, cloud architecture, product reviews, and customer commitments.
Risk management, compliance, and assurance
- Develop a risk-based process for identifying, assessing, prioritizing, treating, and accepting information security and technology risks across Insurity’s ecosystem.
- Maintain alignment with applicable requirements and leading practices, including HIPAA, SOC 2, ISO/IEC 27001, GDPR & the NIST Cybersecurity Framework.
- Orchestrate internal and external audits through planning, evidence collection, testing, findings management, remediation, and executive reporting.
- Establish control ownership, evidence standards, issue-management processes, and sustainable remediation tracking.
- Advise management on the costs, value, and risks of security and technology investments.
- Support cyber-insurance requirements, underwriting reviews, claims preparation, and risk-improvement initiatives.
- Monitor regulatory and contractual changes and translate them into practical requirements, policies, and implementation plans.
- Report material risks, exceptions, incidents, and remediation plans to executive leadership and the Board.
Security operations and incident response
- Lead the enterprise security operations program, including monitoring, threat intelligence, vulnerability management, detection and response, penetration testing, and security investigations.
- Manage security incident response coordinating both internally and externally from inception to resolution.
- Maintain an incident response program that c