layiq

/la·yiq/adjective

worthy; deserving; fitting; suitable.

A role, opportunity, or path that merits attention, time, and pursuit.

Chief Information Security Officer (CISO) at Hippo | LAYIQ

Further develop and execute Hippo's enterprise cybersecurity strategy, aligned with business risk appetite and regulatory requirements
Build and lead the security operations function, including threat detection, incident response, vulnerability management, and threat intelligence
Own Hippo's SOC 2 program end-to-end, including control design, evidence collection, readiness assessments, and auditor engagement
Lead the governance, risk, and compliance function, maintaining the cybersecurity risk register, policy framework, standards, and control library
Drive compliance with applicable state and federal cybersecurity and insurance regulations
Support SEC cybersecurity disclosure obligations in coordination with Legal and Finance
Lead identity governance, including access certification, privileged access management policy, and separation of duties enforcement
Own privacy and data protection compliance strategy, partnering with Legal on data handling, breach notification, and policyholder data protection
Manage the third-party and vendor cybersecurity risk management program
Report to the Board of Directors and Audit and Risk Committee on cybersecurity posture, risk trends, and incident activity
Provide second-line oversight and security control design input to the SOX ITGC program
Build and lead the security engineering function, owning secure design standards and threat modeling practices that ensure security is embedded from architecture through to deployment
Build, mentor, and develop the cybersecurity team and drive a culture of security awareness across the organization
Lead cybersecurity budgeting, roadmap planning, and technology rationalization
Own disaster recovery and business continuity planning across the enterprise, working closely with the CIO and CTO to drive regular testing, validate recovery capabilities, and ensure organizational resilience is aligned to business and cybersecurity risk
Own the enterprise Incident Response Plan, lead the Security Incident Response Team (SIRT) across the full incident lifecycle from detection and containment through recovery and post-incident review, define severity classifications and escalation paths, and ensure cross-functional stakeholders (Legal, Compliance, IT, and executive leadership) are engaged appropriately during active incidents
Drive a continuous improvement program with outcomes tracked to remediation and reported to the Audit and Risk Committee
Lead the enterprise response to supply chain vulnerabilities across open-source dependencies and third-party service providers, owning risk assessment, mitigation, and remediation
Must Haves: 10+ years of progressive experience in cybersecurity or information security, with at least 5 years in a senior security leadership role (CISO, VP of Security, or Head of Information Security)
Experience at a regulated, publicly traded company, including direct involvement in SOX audit cycles
Track record of building and managing security operations capabilities
End-to-end ownership of a SOC 2 program, including control design, audit preparation, and remediation
Experience with cybersecurity regulations in a regulated industry (financial services, insurance, or healthcare preferred)
Strong GRC background with experience maintaining risk registers, policy frameworks, and control libraries
Proven ability to present cybersecurity risk and incident information to boards of directors, audit committees, and regulators
Experience managing third-party and vendor cybersecurity risk programs
Excellent cross-functional leadership skills with a track record of partnering effectively with Legal, Finance, Internal Audit, and Engineering
Nice to Have: Experience in the insurance, Insurtech, or fintech industry
Familiarity with privacy frameworks and data protection requirements (CCPA/CPRA, state breach notification laws)
Relevant certifications such as CISSP, CISM, CRISC, or CISA
Background in security engineering or application security in addition to GRC and security operations
Experience managing cybersecurity programs across multi-entity corporate structures1

Chief Information Security Officer (CISO)

Employer job description

Title:

Location:

Reports To:

About Hippo:

About the Role:

About You:

What You'll Do:

Benefits and Perks:

Equal opportunity and accommodations

About this listing