Location: Remote (United States)
Type: Fractional / Contract
Compensation: Competitive, based on experience and scope
About Triplemoon
Triplemoon is a digital health platform transforming family wellness by addressing critical gaps in mental, behavioral, and nutritional health. We partner with providers, employers and ultimately families to provide accessible, evidence-based mental health resources that improve patient outcomes, increase provider capacity, and boost clinic financials. With growing demand for tailored, mental health resources amidst a shortage of providers (with wait times exceeding 4-6 weeks), Triplemoon is uniquely positioned to solve a critical gap in care for families and clinics. As we grow our collaborative care offering we are adding to our team.
The Opportunity
Triplemoon is seeking a Virtual Chief Information Security Officer (vCISO) to oversee and continuously strengthen our information security, IT operations, and compliance posture. As a fully remote healthcare organization, we rely on secure, scalable technology systems to support our employees, patients, and provider partners.
This role combines strategic information security leadership with hands-on operational oversight. The ideal candidate will serve as Triplemoon's trusted security advisor, ensuring our systems remain secure, compliant, and audit-ready while providing responsive support to our growing remote workforce.
Responsibilities
Information Security & Compliance
- Own the strategy, design, implementation, and continuous improvement of Triplemoon's information security and compliance program.
- Ensure ongoing compliance with HIPAA and healthcare security best practices.
- Lead readiness efforts for future SOC 2 certification and other security frameworks as needed.
- Develop, maintain, and document security policies, procedures, and controls.
- Coordinate security incident response, investigation, remediation, and post-incident reviews.
- Support customer security questionnaires, audits, and compliance requests.
- Partner with leadership to identify, assess, and mitigateinformation security risks.
IT Operational Oversight
- Manage and oversee an IT MSP or MSSP who can:
- Implement security controls and compliance within SaaS vendors and IT systems
- Provide tiered end-user support for hardware, software, and SaaS application issues
- Provide device and asset management
- Manage identity and access, including systems for onboarding and offboarding
- Maintain system documentation, operating procedures, and technology standards.
- Recommend and implement improvements to strengthen security, scalability, and user experience.
Vendor Risk Management
- Conduct security reviews of third-party vendors and software platforms.
- Maintain required security documentation, including BAAs, DPAs, SOC reports, and related compliance artifacts.
- Monitor vendor compliance and support periodic risk assessments.
Qualifications
- 7+ years of experience in information security, IT administration, compliance, or related roles.
- Experience serving as a vCISO, security leader, or senior security consultant.
- Strong knowledge of HIPAA Security Rule requirements and healthcare security best practices.
- Experience preparing organizations for SOC 2 audits and other compliance frameworks.
- Experience supporting early-stage startups or high-growth healthcare organizations.
- Hands-on experience administering Google Workspace, identity management platforms, endpoint management tools, and SaaS environments.
- Familiarity with remote workforce security and cloud-first technology environments.
- Excellent documentation, communication, and stakeholder management skills.
- Ability to operate independently while serving as a strategic advisor to company leadership.
Preferred Qualifications
- Experience working with and configuring cloud-native SaaS stacks for regulatory compliance, such as Vanta, 1Password, Google Workspace, Rippling, and other cloud-based healthcare technology platforms.
Success in This Role
The successful vCISO will ensure that:
- Triplemoon maintains a strong security and compliance posture.
- Security controls are documented, monitored, and continuously improved.
- Systems remain reliable and well-supported for a fully remote workforce.
- Customer security reviews and audits are completed efficiently and confidently.
- Triplemoon remains audit-ready and positioned for future compliance milestones, including SOC 2 readiness.
- IT issues, including onboarding and offboarding, are handled securely and consistently.
