UltraSight - Chief Information Security Officer

Are you ready to join Connecticut Innovation’s vibrant community of innovators? Connecticut Innovations (“CI”) is Connecticut’s strategic venture capital arm, and we are passionate about serving our portfolio of 220+ companies across various industries, with strengths in life sciences, technology, and climate tech.Come join UltraSight- AI Powered Cardiac Ultrasound!About UltraSight UltraSight is a medical technology company developing AI-powered solutions designed to make cardiac ultrasound more accessible and easier to use. Our multidisciplinary team combines software engineering, artificial intelligence, clinical expertise, product development, and medical-device quality and regulatory practices. About the Role We are a medical software startup building software that has a direct impact on healthcare delivery and patient care. As we grow our product, customer base, and regulatory footprint, security must remain embedded in how we design, develop, operate, and support our technology. We are looking for a hands-on Chief Information Security Officer (CISO) to own and lead our information security and cybersecurity program. This is not a large-enterprise, governance-only role. The ideal candidate is comfortable defining security strategy, working directly with engineers and product teams, responding to customer security requirements, managing compliance activities, and personally driving implementation where needed. The CISO will work closely with R&D, Product, Quality/Regulatory, IT, Legal, and company leadership, and will serve as the company's primary security leader with customers, partners, auditors, and other external stakeholdersSecurity Strategy & Governance Own the company's information security and cybersecurity strategy, roadmap, policies, and risk management framework. Establish a security program appropriate for a fast-growing medical software company. Identify, assess, prioritize, and communicate security risks to executive leadership. Define security KPIs, risk metrics, and reporting for management, as appropriate. Maintain and continuously improve security policies, procedures, standards, and controls. Drive a practical security culture across the company without creating unnecessary friction for engineering or business teams.Product & Application Security Partner closely with R&D and Product to integrate security throughout the software development lifecycle. Lead threat modeling, security architecture reviews, and secure design practices. Define secure coding, dependency management, secrets management, vulnerability management, and security testing practices. Guide penetration testing and vulnerability assessments, and ensure findings are appropriately remediated. Review product architecture, APIs, cloud infrastructure, data flows, and third-party integrations from a security perspective. Support cybersecurity activities required for medical-device or regulated healthcare software, including security risk analysis, threat modeling, vulnerability assessment, and post-market cybersecurity processes.Cloud & Corporate Security Own security requirements and oversight for cloud infrastructure, endpoints, identity management, SaaS applications, and corporate IT. Establish and maintain appropriate controls around authentication, authorization, MFA, privileged access, encryption, logging, monitoring, backup, and disaster recovery. Lead vulnerability management across cloud, software, endpoints, and third-party components. Evaluate and deploy security tools appropriate for the company's size, risk profile, and stage.Compliance & Regulatory Own or co-own security-related compliance initiatives, including frameworks and requirements such as: SOC 2 ISO 27001 HIPAA and healthcare privacy/security requirements GDPR and applicable data protection and privacy requirements FDA and other applicable medical-device cybersecurity requirements Customer and partner security requirements Work closely with Quality, Regulatory, and Legal teams on security and privacy aspects of the Quality Management System, product risk-management processes, and data handling practices. Coordinate security audits, assessments, penetration tests, and customer due diligence activities. Maintain security and privacy documentation and evidence required for audits and regulatory submissions. Translate regulatory, privacy, and compliance requirements into pragmatic engineering and operational controls.Incident Response & Business Continuity Establish and maintain the company's security incident response program.Lead investigation and response to security incidents and suspected breaches, including appropriate handling of potential personal-data breaches.Define escalation, communication, containment, remediation, and post-incident review processes.Coordinate tabletop exercises and incident response simulations.Partner with relevant teams on business continuity and disaster recovery planning and testingCustomer & Partner Security Act as the security point of contact for strategic customers, healthcare organizations, partners, and vendors. Lead responses to customer security questionnaires and security reviews. Participate in customer meetings where security, privacy, architecture, or risk topics are discussed. Support Sales and Business Development in communicating the company's security posture clearly and credibly. Review security and data-protection requirements in customer and partner agreements, in collaboration with Legal and leadership.Third-Party & Supply-Chain Security Establish a risk-based vendor and third-party security assessment processEvaluate critical vendors, cloud providers, software dependencies, and service providers. Define security and data-protection requirements for suppliers and partners handling sensitive company, personal, or healthcare information. Maintain visibility into third-party and software supply-chain risksSecurity Awareness Build security awareness across the organization. Provide practical training for employees, developers, administrators, and managers. Create clear security guidance that enables employees to make good security decisions independentlyQualificationsSignificant experience leading information security, cybersecurity, or product security programs.Strong hands-on technical understanding of modern software development, cloud infrastructure, application security, and security architecture.Experience securing SaaS, cloud-native, or software-based products. Experience with at least several of the following: AWS, Azure, or GCP security Application and API security Identity and access management Secure SDLC Vulnerability management Penetration testing Incident response Security monitoring Data protection and encryption DevSecOps Experience implementing or operating security frameworks such as ISO 27001, SOC 2, NIST CSF, or similar. Familiarity with privacy and data-protection principles and their practical application to software products and cloud environments. Ability to perform security risk assessments and turn findings into clear, prioritized actions. Strong communication skills and the ability to work effectively with engineers, executives, auditors, customers, and regulators. Ability to balance security, regulatory requirements, development velocity, usability, and business priorities. Comfortable operating independently in a startup environment with limited resources and a high degree of ownershipStrongly Preferred QualificationsExperience in medical devices, digital health, healthcare software, or another highly regulated industry. Familiarity with medical-device cybersecurity and risk-management practices. Experience with FDA cybersecurity expectations and healthcare security requirements. Familiarity with ISO 14971, IEC 62304, ISO 13485, and related medical-device standards. Experience with HIPAA and protection of PHI. Familiarity with GDPR and privacy requirements relevant to healthcare and software products. Experience supporting security assessments by hospitals, health systems, enterprise customers, or strategic partners. Experience building a security program in an early-stage or growth-stage company. Relevant certifications such as CISSP, CISM, CCSP, or equivalent practical experienceEQUAL OPPORTUNITY EMPLOYERConnecticut Innovations and its portfolio companies are an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. We have strict wage minimums, generous benefits, and personal leave policies. Our goal is to provide safe, rewarding, and empowering work environments for all who interact with our company and/or portfolio companies.