Job Title:Head of Information SecurityAbout Bluedrop MedicalBluedrop Medical is a rapidly growing medical device company pioneering technology that enables early detection and remote monitoring of diabetic foot ulcers. Our mission is to reduce hospitalizations and amputations through intelligent, connected healthcare. Data security, patient privacy, and regulatory compliance are core to delivering on that promise.Role OverviewWe are seeking an experiencedHead of Information Securityto lead and evolve our global security and compliance posture. This role is critical in shaping and delivering our security strategy, overseeing the maintenance and implementation of frameworks includingISO 27001,SoCand ensuring robust, scalable protection of sensitive health and operational data.The ideal candidate will be a strong leader with hands-on experience in regulated environments (preferably healthcare), a deep understanding of cloud security, and a track record of achieving security certifications in startup or growth-stage organizations.Responsibilities:Develop, lead, and continuously improve Bluedrop' s information security program.Define and enforce policies and procedures aligned with ISO 27001, NIST CSF, HIPAA standards.Oversee risk assessments, vulnerability management, incident response, and third-party risk processes.Manage and prepare for external audits and certifications (e.g., ISO 27001, FedRAMP readiness assessments, HIPAA audits).Collaborate with DevOps teams on the design and implementation of cloud security architectures.Collaborate with engineering, QA, clinical, and operations teams to embed secure development practices (DevSecOps).Train staff on security awareness and maintain a culture of proactive risk mitigation.Represent security in customer engagements, board meetings, and regulatory discussions.Serve as the Data Protection Officer (DPO) or support the DPO in GDPR-related obligations, if required.Required Qualifications7+ years in information security, with at least 2+ years in a senior leadership role.Proven experience with ISO 27001 implementation and certification.Strong knowledge of HIPAA security/privacy rules and practical healthcare compliance frameworks.Familiarity with NIST CSF and FedRAMP (even at the readiness or planning stage).Deep understanding of cloud-native security (AWS, Azure, or GCP).Demonstrated success leading security audits, risk assessments, and driving remediation.Experience in regulated industries, preferably medical devices, digital health, or healthcare SaaS.Excellent interpersonal and communication skills; capable of engaging both technical and non-technical stakeholders.Desirable QualificationsCertifications such as CISSP, CISM, CISA, CCSP, or ISO 27001 Lead Implementer .Experience working with US federal compliance (e.g., NIST SP 800-53, FISMA).Exposure to device-level security, Bluetooth/IoT threat modelling, or secure firmware lifecycle (bonus).Familiarity with DevSecOps pipelines and CI/CD security tooling.What we offerA key leadership role in a high impact MedTech startup improving patient outcomes.Competitive salary and stock options.Hybrid/flexible working arrangements.Opportunity to shape a security program from the ground up.Supportive, mission-driven culture.