Senior Manager, IT Security

Job Description Summary ‎ At Castlight, we are looking for a Senior Manager, IT Security who operates as an impactful player-coach, bridging deep technical security execution with strategic, client-facing leadership. Reporting directly to the Head of Technology, you will lead a dedicated security team while actively contributing to GCP cloud and application security, supporting our internal audit team across SOC 2, HITRUST, and NIST, and championing our security posture to major employers and health plans. Whether you are guiding AppSec best practices, defending our architecture on a CISO call, or serving as the steady client bridge during an incident, you will be the guardian of the trust and systems that power healthcare journeys for millions of users. If you are a high-agency leader who thrives at the intersection of hands-on security engineering and executive commercial engagement, we want to talk to you. ‎ How will you make an impact & Requirements ‎ Who We Are: At Castlight, we’re making it as simple as humanly possible for people to navigate the complicated, often frustrating, world of healthcare. We partner with America’s largest employers and health plans, transforming employee benefits into a deeply personalized and guided journey for millions of users. What we build genuinely helps people live happier and healthier lives.

What You'll Do: Reporting directly to the Head of Technology, you will lead Castlight's dedicated security organization while driving customer-facing security trust and hands-on technical execution. Operating as a true player-coach, you will balance team leadership and strategic governance, direct technical and architectural execution, and client enablement and support.

In this role, you will:

Skills & Qualifications:

• Leadership Experience: 7+ years of progressive information security experience, including demonstrated success leading, coaching, and mentoring technical security engineers in a player-coach capacity. • Client-Facing Acumen: Proven capability to interact directly with enterprise customer security leaders, procurement specialists, and health plan CISOs. Experience reviewing security contract terms, supporting enterprise RFPs, and articulating complex security postures to external stakeholders. • Technical AppSec & Cloud Depth: Hands-on experience with Application Security (DAST, secure SDLC, CI/CD pipeline controls) and Cloud Security architecture, with an emphasis on Cloud Platform (We run GCP - but any cloud platform is sufficient) and containerized/microservice ecosystems. • Security Framework Familiarity: Working knowledge of SOC 2, HITRUST, and NIST frameworks, with a track record of implementing technical controls and supporting auditability. • Crisis Management & Communication: Exceptional communication and presentation skills, with the ability to maintain composure during security incidents and clearly explain root cause, blast radius, and remediation roadmaps to client leadership. • Cross-Functional Collaboration: Demonstrated ability to partner effectively with Engineering, Product, Legal, and executive leadership, balancing defense-in-depth with business momentum. ‎ Compensation Range: $144,368.00 to $216,552.00 The anticipated base salary range represents the Company's good-faith estimate of the compensation it reasonably expects to pay for this position at the time of posting. Actual compensation will be determined based on factors including experience, skills, qualifications, geographic location, internal equity, and business needs.