Manager, Information Security

About Rethink First

Rethink First is a leading behavioral health technology company working to make mental wellness, education, and support accessible and scalable. Through our suite of cloud-based platforms—including Rethink Ed, Rethink Care, and Rethink

BH—we serve educators, employers, and providers with tools that deliver measurable, inclusive outcomes.

We're on a mission to make behavioral health more effective, equitable, and human—and we’re looking for a creative visionary to help lead that charge.

About the Role

We are building a modern, cloud-forward security program grounded in Cyber Resilience, Application Security, and Security Assurance. As our Manager, Information Security, you will be the operational and execution leader for our Security Assurance function while helping shape key processes across Sec Ops and App Sec.

This role is ideal for someone who thrives in a high-growth SaaS environment, collaborates well cross-functionally, and wants to help mature a security program that must support HIPAA, SOC 2 Type II, HITRUST, and a broad healthcare customer base.

You will own the day-to-day execution of GRC, Audit Readiness, Evidence Collection, Policy Management, TPRM, and Client Trust—and must have hands‑on experience implementing or operating Vanta as a centralized compliance automation platform.

You will serve as a multiplier for the Sr Director, creating repeatable processes, driving deadlines, maturing documentation, and ensuring audit‑ready control operation across Azure, M365, and our SaaS product ecosystem.

Key Responsibilities

Security Assurance Leadership (Primary Responsibility – 60%)

• Lead the end-to-end Security Assurance function across SOC 2, HIPAA, HITRUST, and regulatory frameworks.

• Act as the program manager for all audits, coordinating with Legal, HR, Engineering, Product, and Infrastructure to maintain year‑round audit readiness.

• Own the implementation, configuration, optimization, and continuous operation of Vanta, including:
- Control mapping and ownership assignments
- Evidence collection workflows
- Vendor risk management modules
- Client Trust functionality (best answers, trust portal, knowledge base)

• Build and maintain an audit calendar, evidence repository, and standardized evidence collection playbooks.

• Drive development and continuous maintenance of security policies, standards, and procedures.

• Operate the Third‑Party Risk Management process, including vendor classification (Tier 1/BAA), questionnaire review, residual risk scoring, and contract security review.

• Respond to customer security questionnaires, RFPs, and client audit requests with clarity, accuracy, and speed.

Cyber Resilience & Sec Ops Leadership (25%)

• While not a hands‑on Sec Ops role, you will:

• Partner with the Sec Ops Engineers to build daily operational cadence across alerts, incidents, vulnerability management, and hygiene controls.

• Ensure controls monitored by Tenable, Microsoft Defender, Sentinel, and other platforms produce audit‑ready evidence.

• Help design operational dashboards and KPIs for incident response, vulnerability SLAs, and hygiene metrics.

• Validate operational controls for compliance frameworks (MFA, SSO, logging, monitoring, access reviews, backups, endpoint security, network protections, etc.).

Application Security Collaboration (15%)

• Work with Engineering, Architecture, and Dev Ops teams to ensure Product and App Sec controls align with SOC 2 and HITRUST expectations.

• Contribute to secure SDLC processes, risk assessments for new features, and remediation tracking for vulnerabilities and findings.

• Validate that security requirements are integrated into CI/CD workflows where appropriate.

Required Qualifications

• 7+ years of progressive experience in Information Security, with at least 3+ years in a governance, compliance, or Security Assurance leadership role.

• Direct experience implementing or operating Vanta (must be hands‑on).

• Strong experience supporting and maturing SOC 2 Type II, HIPAA Security Rule, and HITRUST programs in a SaaS environment.

• Deep understanding of Microsoft Azure security architecture, including Entra , RBAC, Conditional Access, Defender for…