Information Security Lead

Who We Are: Click Therapeutics, Inc., develops, validates, and commercializes software as prescription medical treatments for people with unmet medical needs. As a leading innovator of Digital Therapeutics™, Click delivers accessible, clinically proven, FDA-regulated prescription treatments to the smartphone in your hand. Click’s treatments are defined by a commitment to applying technical and scientific rigor and patient-centric design to the development process. This results in uniquely engaging experiences that achieve compelling clinical outcomes for patients seeking new treatment options. Click Therapeutics continuously expands and refines its platform with novel cognitive, behavioral and neuromodulatory mechanisms of action and advanced data-driven tools such as artificial intelligence and machine learning. The digital therapeutics under development on Click’s platform address diverse areas of therapeutic need, including indications in psychiatry, neurology, oncology, immunology, and cardiometabolic diseases. Consistently named a best place to work, Click fosters an inclusive, diverse workforce of innovators, clinicians, scientists, researchers, designers, technologists, engineers and more, united in a common mission to provide patients everywhere access to safe and effective prescription digital therapeutics. For more information, visit www.clicktherapeutics.com and connect with us on LinkedIn. About the Role: As Information Security Lead, you'll be at the forefront of safeguarding our groundbreaking digital therapeutics. We're seeking an individual with deep technical expertise in information security in the healthcare sector, ready to tackle complex challenges and pioneer innovative solutions. This isn't just a role; it's an opportunity to build, mentor, and inspire a high-performing team, while strategically collaborating across diverse departments to embed security into the very fabric of our revolutionary products. Your ability to swiftly master new technologies and meticulously adhere to processes in a highly regulated environment will be crucial as you champion information security across every facet of our company and with all our valued partners. This position is based out of Click’s headquarters located in Tribeca, NYC, at the center of one of the fastest-growing digital health communities. We have a hybrid working model that consists of at least 4 days in office each week. Responsibilities: Maintain, and continually improve the Information Security Management System (ISMS) to maintain relevant certifications (e.g., ISO 27001, SOC 2, IEC 81001-5-1 and UK Cyber Essentials Plus). Lead the technical security aspects of data privacy to ensure compliance with GDPR, CCPA, and HIPAA. Lead and mature the company's Security Operations Center (SOC) capabilities, including threat intelligence, monitoring, detection, and analysis. Responsible for collecting, analyzing, escalating, and responding to cybersecurity vulnerabilities, threats, and attacks using SIEM and EDR technologies. Collaborate with Engineering to ensure Secure Development Lifecycle (SDLC) practices are followed, integrating threat modeling, static/dynamic analysis, fuzz testing, and formal verification into the development process. Develop and maintain reporting of Key Performance Indicators (KPIs) of threats and incidents, including incident response timeliness and general observability metrics. Oversee security testing activities, including penetration testing and vulnerability scanning. Conduct security training and awareness programs for employees to promote a culture of security. Oversee all third-party and vendor risk management activities Collaborate with Quality and Regulatory on cybersecurity processes Support regulatory submissions by generating Cybersecurity Quality Management System (QMS) documentation, ensuring compliance with FDA Cybersecurity Guidance (2025), EU MDR, NIST 800-53, IMDRF, and AAMI TIR57. Qualifications: Experience within a highly regulated industry such as medical devices, pharmaceuticals, biotechnology, or healthcare Understanding of common security frameworks and standards, including NIST Cybersecurity Framework (CSF), ISO 27001/27002, and SOC 2. Knowledge of risk assessment methodologies, threat modeling, network security, cloud security (AWS), application security, and data protection technologies. Experience leading or participating in formal security audits. Experience in interfacing with engineering teams and running in tiger-teams or embedded SME Scrum teams. Leadership and communication skills, with the ability to articulate complex security concepts to technical and non-technical audiences. Compensation: The base salary range for this position is between: $130,000 - $180,000. The final base salary will be dependent upon skills, experience and location. In addition to the base salary, Click Therapeutics offers an annual performance-based cash bonus and a generous equity package. Benefits: The role includes great benefits and is an excellent wealth-building opportunity at a fast-growing pre-IPO company in a nascent and extremely exciting space. Competitive Salary with Annual Review | Cash Bonus | Stock Options | 5% 401(k) matching | Medical | Dental | Vision | Life Insurance | Voluntary Benefits | Unlimited PTO | Uber One | Nectar Rewards | One Medical | Fertility Support | Fitness Reimbursement | Bike Membership | Professional Development Stipend | DoorDash and Catered Lunches | Parent Benefits | LinkedIn Learning | Gemini Enterprise Stack | Industrious Workspaces | Commuter Subsidies | Flexible Work Arrangement | Choice of Mac or Windows | Sponsored Company Events | Office Snacks and Beverages | Much More… Equal Employment Opportunity: Click Therapeutics is committed to equal opportunity in the terms and conditions of employment for all employees and job applicants without regard to race, color, religion, sex, sexual orientation, age, gender identity or gender expression, national origin, disability or veteran status. Click Therapeutics also complies with all applicable national, state and local laws governing nondiscrimination in employment as well as employment eligibility verification requirements of the Immigration and Nationality Act. All applicants must have authorization to work for Click Therapeutics in the U.S. In certain circumstances it may be advantageous to Click Therapeutics to support the application(s) for temporary visa classification and/or sponsor applications for permanent residence so that a foreign national colleague can accept or remain in a work assignment in the U. S. For certain classes of temporary visas, the resulting work authorization may be specific to Click Therapeutics and the specific job and/or work site. Click Therapeutics may at its business discretion decide to or refrain from obtaining, maintaining and/or extending the temporary visa status and/or sponsoring a colleague for permanent residency and /or employment eligibility, considering factors such as availability of qualified U.S. workers and the colleague's long-term prospects for securing lawful permanent residence, among other reasons. Employment applicants requiring immigration sponsorship must disclose, when initial application for employment is made, whether or not they are legally authorized to work for Click Therapeutics in the U.S. and, if so, whether that authorization permits them to work in the job they seek. In no case should Click Therapeutics support of a colleague's temporary visa application or sponsorship of a colleague for permanent residence be construed to guarantee success of that application or amend or otherwise invalidate the "at-will" employment relationship between the colleague and Click Therapeutics. Recruitment Phishing Scams: Fake job advertisements and offers are increasingly appearing on the internet. If you have encountered a job posting or have been approached with a job offer that you suspect may be fraudulent, we strongly recommend you do not respond and report it to the Federal Trade Commission and the FBI at https://www.ic3.gov/Home/ComplaintChoice. Please be mindful of the following: Click Therapeutics will only reach out to you through an “@clicktherapeutics.com” email address. Other than your email address or telephone number, which you may provide via a job application portal, Click Therapeutics will never ask you to provide personally identifiable information about yourself (such as a Social Security Number or Driver’s License Number) via a messaging application (like that used on the LinkedIn platform or Microsoft Teams). Click Therapeutics will conduct interviews face-to-face over Zoom. All job postings will be listed on the Click Therapeutics official career page.