IT & Information Security Manager

At Cureety, we develop digital solutions that support people living with cancer and help healthcare teams monitor patients throughout their care journey.

As we expand across Europe following our acquisition of Reimagine Care in the United States, we are looking for an IT & Information Security Manager to lead our information security program and oversee our outsourced internal IT.

Your challenge: anticipate the risks that come with growth, strengthen security in everyday operations, and establish shared practices across our European and US activities. You will build on an existing ISO 27001-certified Information Security Management System (ISMS).

We are looking for someone who can deliver today and grow with the organization, with the potential to take on broader global CIO/CISO responsibilities over time.

Your role

Working directly with executive leadership, you will own the information security program and drive its implementation with our teams.

You will partner closely with the CTO, in a role separate from technical leadership. Our external IT provider handles day-to-day internal IT support and operations.

Your main responsibilities:

• Lead security and risk management: identify key risks, define the roadmap and drive risk treatment plans through remediation or escalation for decisions on residual risk.

• Strengthen operational security: agree appropriate protections for our cloud and SaaS environments with the CTO, coordinate security testing and verify that remediation is effective.

• Prepare for incidents and ensure resilience: lead incident preparedness and response coordination, bring the right people together and organize security and business continuity exercises.

• Embed security into everyday work: maintain and improve the ISMS, develop security awareness and help teams adopt practices suited to their work.

• Oversee internal IT and third parties: manage our IT provider, strengthen oversight of devices, tools and access, assess supplier security and support new integrations.

• Demonstrate the effectiveness of our security program: maintain ISO 27001 certification, coordinate SOC 2 readiness and the implementation of HIPAA requirements for our US activities, and lead audits and responses to customer and partner security requests.

You will work closely with Legal, Privacy and Quality to protect the sensitive data we handle. You will give leadership a clear view of risks, progress and decisions requiring their attention.

You have already led an information security program and delivered measurable improvements to an organization’s security. You can move from assessing a risk to working through its resolution with technical teams. You bring: Solid experience in security risk management and delivering security improvements. The technical understanding to challenge security controls across cloud infrastructure, identities, access and data protection. Strong working knowledge of ISO 27001 and information security management systems. The ability to manage partners and bring technical and business teams together. At least one relevant certification: CISM, CISSP, ISO 27001 Lead Implementer / Lead Auditor, or an equivalent credential. Fluent professional English, both spoken and written. Experience with SOC 2 and/or HIPAA, outsourced IT providers, or SaaS, healthcare or medical device environments would be an advantage. You can prioritize, make a clear case for your recommendations and propose measures proportionate to the risks. You enjoy building structure while staying directly involved in solving practical problems with teams. You are interested in developing a broader global leadership remit across information security and corporate IT as Cureety grows.

Why join Cureety? Meaningful ownership of security, with direct access to executive leadership. An international program to shape, working with European and US teams during a key period of integration and growth. Room to grow your responsibilities, combining security leadership with oversight of corporate IT. A tangible purpose: protecting the data and services used by patients and healthcare professionals.