Virta Health is on a mission to transform type 2 diabetes and weight-loss care. Current treatment approaches aren’t working—over half of US adults have either type 2 diabetes or prediabetes, and obesity rates are at an all-time high. Virta is changing this by helping people reverse their metabolic condition through innovations in technology, personalized nutrition, and virtual care delivery reinvented from the ground up. We have raised over $350 million from top-tier investors, and partner with the largest health plans, employers, and government organizations to help their employees and members restore their health and take back their lives. Join us on our mission to reverse diabetes and obesity in one billion people.As Vice President of Information Technology and Security, you will serve as a critical member of the leadership team, responsible for defining and executing the security and IT vision across the organization. You will lead efforts to architect and build secure, scalable systems that power our mission-critical applications, while ensuring that enterprise security and IT operations enable productivity and resilience at scale. This role combines deep technical acumen with strategic oversight and cross-functional leadership.You’ll be instrumental in enabling our AI efforts to scale securely, allowing developers to focus on solving complex problems without being encumbered by infrastructure or operational and legal risks. Your influence will span from product design to employee experience, making you a key decision-maker in the company’s long-term strategy.<h1> Key Responsibilities</h1>Security Architecture &amp; Product Security<ul><li>Lead product and application security strategy, including secure design, development, deployment, and monitoring. </li><li>Oversee secure configuration and continuous assessment of cloud environments (GCP), containers, APIs, and developer workflows. </li><li>Partner with engineering and product teams to embed secure-by-design practices and eliminate security and privacy risks early in the SDLC. </li><li>Drive secure delivery of our AI platform in compliance with regulatory and industry frameworks. </li></ul>Corporate Security &amp; IT Leadership<ul><li>Own the full lifecycle of corporate IT, from onboarding to offboarding, including identity management, endpoint protection, and employee enablement. </li><li>Build and manage IT policies, practices, and tooling to ensure minimal friction for staff while maintaining rigorous security standards. </li><li>Oversee SaaS tool governance, device fleet security, and MDM configuration to protect company assets. </li><li>Ensure corporate infrastructure supports remote-first, distributed teams efficiently and securely. </li></ul>Governance, Risk &amp; Compliance<ul><li>Lead all aspects of security compliance programs and audits, including HIPAA, HITRUST, SOC 2, and ISO 27001. </li><li>Partner with legal, privacy, engineering, and operations to ensure risk assessments, policies, and controls meet evolving regulatory requirements. </li><li>Monitor controls for access, vulnerability management, incident response, and business continuity. </li></ul>Team Building &amp; Leadership<ul><li>Hire, mentor, and manage high-performing teams across InfoSec, security engineering, and corporate IT. </li><li>Cultivate a culture of transparency, ownership, and continuous improvement. </li><li>Educate and empower employees on secure practices and foster cross-functional collaboration. </li></ul><h1>Qualifications</h1>We’d love to hear from you if you have:<ul><li>15+ years of IT and cybersecurity experience, including 5+ years in senior leadership roles (VP, Senior Director). </li><li>Proven leadership experience in both information security and corporate IT domains. </li><li>Demonstrated success securing enterprise applications and platforms, particularly in AI/ML or cloud-native environments. </li><li>Hands-on experience with IT framework, and cloud platforms such as Google Cloud Platform (GCP). </li><li>Strong knowledge of secure software development practices, CI/CD, and developer enablement. </li><li>A track record of successfully managing IT operations, SaaS administration, endpoint security, and helpdesk experience. </li><li>Experience leading third-party certifications and audits (e.g., HIPAA, HITRUST, SOC 2, ISO 27001). </li><li>Exceptional communication skills, with the ability to explain complex topics to technical and non-technical stakeholders, including Virta’s Executive leadership team and its Board of Directors. </li><li>A passion for enabling developers and employees by balancing security with usability. </li></ul><h1>Preferred Qualifications</h1><ul><li>Experience in a high-growth startup or remote-first company. </li><li>Familiarity with MDM tools, SSO/IDP platforms (e.g., Okta), and SIEM solutions. </li></ul><h1>90-Day Plan for VP of Information Technology and Security</h1><h3>Days 0–30: Listen &amp; Learn (Foundational Immersion)</h3>Objective: Build a strong understanding of current security posture, IT systems, team dynamics, and existing AI use cases or experimentation across departments.Key Activities<ul><li>Organizational Immersion <ul><li>Meet with executive leadership to understand company strategy, growth goals, IT and InfoSec pain points and AI priorities. </li><li>Identify departments currently using or planning to use AI (e.g., support automation, clinical ops, engineering, legal). </li><li>Review internal AI usage guidelines, current OpenAI or third-party LLM contracts, and any prior security assessments. </li></ul></li><li>Team &amp; Systems Review <ul><li>Conduct 1:1s with Security, IT, and cross-functional stakeholders (Product, Engineering, Data Science/AAa, Legal, Privacy, HR). </li><li>Audit enterprise tools, endpoints, cloud infrastructure, and integrations that interface with AI/ML workloads. </li><li>Inventory all known AI usage: internal tools, SaaS platforms with embedded AI, custom LLMs, and shadow AI adoption. </li></ul></li><li>Security &amp; Compliance Discovery <ul><li>Review existing policies related to acceptable AI use, data classification, and PHI/PII handling in AI systems. </li><li>Identify risks around sensitive data exposure, model drift, and external AI API calls. </li><li>Assess current alignment with frameworks such as NIST AI RMF, HIPAA, and HITRUST for AI governance. </li></ul></li></ul>Deliverables<ul><li>AI adoption baseline and department-level inventory </li><li>Internal stakeholder map for AI governance </li><li>Current-state security/IT summary </li><li>Initial risk areas for AI usage </li><li>Shortlist of AI cost-saving opportunities (e.g., license consolidation, helpdesk automation, AI-assisted triage) </li></ul><h3>Days 31–60: Evaluate &amp; Strategize (Design &amp; Prioritize)</h3>Objective: Define a secure, scalable, and cost-efficient framework for AI usage while driving improvements across security and IT.Key Activities<ul><li>AI Governance Framework <ul><li>Develop a lightweight, business-friendly AI governance model: acceptable use, human-in-the-loop requirements, data inputs/outputs, and usage approvals. </li><li>Work with Legal and Privacy to address data residency, PHI exposure, and contractual guardrails for AI vendors. </li><li>Define clear lines of ownership for AI tooling and model integration into internal workflows. </li></ul></li><li>Cost-Saving AI Enablement <ul><li>Identify specific operational areas for AI enablement (e.g., Zendesk ticket classification, onboarding FAQs, coding support, reporting automation). </li><li>Prioritize use cases that reduce SaaS sprawl or eliminate manual effort (e.g., documentation, internal training). </li><li>Evaluate internal AI solutions vs. vendor platforms for optimal cost control. </li></ul></li><li>Security &amp; IT Enhancements <ul><li>Roll out quick-win security upgrades (SSO enforcement, device posture, GCP policy tightening). </li><li>Draft or revise security/IT policies (including AI usage, endpoint protection, access control). </li><li>Identify key automation opportunities in corporate IT (e.g., offboarding workflows, MDM enforcement, helpdesk triage with AI). </li></ul></li></ul>Deliverables<ul><li>AI governance policy (draft) </li><li>12-month Security, IT, and AI strategy roadmap </li><li>AI enablement scorecard (use case, business impact, cost delta) </li><li>Proposed AI pilot programs with success criteria </li></ul><h3>Days 61–90: Execute &amp; Lead (Scale &amp; Secure)</h3>Objective: Begin executing foundational work across Security, IT, and AI enablement. Institutionalize governance and operationalize scalable, secure AI usage.Key Activities<ul><li>AI Enablement &amp; Scaling <ul><li>Launch initial AI pilots in prioritized departments (e.g., IT support automation, compliance reporting, auto-drafting engineering documentation). </li><li>Develop dashboards to track AI adoption, model usage, cost, and business impact. </li><li>Partner with Engineering/AAA to embed security into model pipelines (input validation, logging, hallucination handling). </li></ul></li><li>Security &amp; Compliance Operations <ul><li>Finalize and publish core security and AI usage policies; begin annual review cadences. </li><li>Implement monitoring controls for AI API usage, cost alerts, and sensitive data access. </li><li>Launch internal training on secure and responsible AI use for employees. </li></ul></li><li>Efficiency Gains in Corporate IT <ul><li>Deploy tooling to support onboarding/offboarding automation with least-privilege principles. </li><li>Enable frictionless employee experience (self-service support, AI-first helpdesk, unified endpoint management). </li><li>Close key audit gaps; initiate pre-certification steps for SOC 2 or HITRUST if needed. </li></ul></li><li>Culture &amp; Communication <ul><li>Publish monthly Security &amp; IT newsletters with transparency on risks, initiatives, and metrics. </li><li>Host “AI Office Hours” to encourage responsible experimentation and collect feedback. </li><li>Establish a cross-functional “AI Task Force” to guide innovation and policy. </li></ul></li></ul>Deliverables<ul><li>Implemented AI pilots with documented ROI or time savings </li><li>Live dashboards tracking AI usage and impact </li><li>Finalized and rolled out policies (security, IT, AI use) </li><li>Security training completion metrics </li><li>Executive briefing deck on 90-day outcomes and 12-month strategic plan</li></ul><h1></h1><h1>Values-driven culture</h1>Virta’s company values drive our culture, so you’ll do well if:<ul><li>You put people first and take care of yourself, your peers, and our patients equally</li><li>You have a strong sense of ownership and take initiative while empowering others to do the same</li><li>You prioritize positive impact over busy work</li><li>You have no ego and understand that everyone has something to bring to the table regardless of experience</li><li>You appreciate transparency and promote trust and empowerment through open access of information</li><li>You are evidence-based and prioritize data and science over seniority or dogma</li><li>You take risks and rapidly iterate </li></ul>Is this role not quite what youre looking for?<a target="_blank" href="https://forms.gle/XL7AGsAPZ7rp7gGV6"> Join our Talent Community</a> and<a target="_blank" href="https://www.linkedin.com/company/virta-health"> follow us on Linkedin</a> to stay connected!Virta has a location based compensation structure. Starting pay will be based on anumber of factors and commensurate with qualifications &amp; experience. Forthis role, the compensation range is $225,000-$285,000 plus bonus and equity. Information about Virta’s benefits is on our Careers page at: <a target="_blank" href="https://www.virtahealth.com/careers">https://www.virtahealth.com/careers</a>.As part of your duties at Virta, you may come in contact with sensitive patient information that is governed by HIPAA. Throughout your career at Virta, you will be expected to follow Virtas security and privacy procedures to ensure our patients information remains strictly confidential. Security and privacy training will be provided.As a remote-first company, our team is spread across various locations with office hubs in Denver and San Francisco. Clinical roles: We currently do not hire in the following states: AK, HI, RI Corporate roles: We currently do not hire in the following states: AK, AR, DE, HI, ME, MS, NM, OK, SD, VT, WI.#LI-remote