Chief Information Security Officer (CISO)

What you'll do

• Further develop and execute Hippo's enterprise cybersecurity strategy, aligned with business risk appetite and regulatory requirements
• Build and lead the security operations function, including threat detection, incident response, vulnerability management, and threat intelligence
• Own Hippo's SOC 2 program end-to-end, including control design, evidence collection, readiness assessments, and auditor engagement
• Lead the governance, risk, and compliance function, maintaining the cybersecurity risk register, policy framework, standards, and control library
• Drive compliance with applicable state and federal cybersecurity and insurance regulations
• Support SEC cybersecurity disclosure obligations in coordination with Legal and Finance
• Lead identity governance, including access certification, privileged access management policy, and separation of duties enforcement
• Own privacy and data protection compliance strategy, partnering with Legal on data handling, breach notification, and policyholder data protection
• Manage the third-party and vendor cybersecurity risk management program
• Report to the Board of Directors and Audit and Risk Committee on cybersecurity posture, risk trends, and incident activity
• Provide second-line oversight and security control design input to the SOX ITGC program
• Build and lead the security engineering function, owning secure design standards and threat modeling practices that ensure security is embedded from architecture through to deployment
• Build, mentor, and develop the cybersecurity team and drive a culture of security awareness across the organization
• Lead cybersecurity budgeting, roadmap planning, and technology rationalization
• Own disaster recovery and business continuity planning across the enterprise, working closely with the CIO and CTO to drive regular testing, validate recovery capabilities, and ensure organizational resilience is aligned to business and cybersecurity risk
• Own the enterprise Incident Response Plan, lead the Security Incident Response Team (SIRT) across the full incident lifecycle from detection and containment through recovery and post-incident review, define severity classifications and escalation paths, and ensure cross-functional stakeholders (Legal, Compliance, IT, and executive leadership) are engaged appropriately during active incidents
• Drive a continuous improvement program with outcomes tracked to remediation and reported to the Audit and Risk Committee
• Lead the enterprise response to supply chain vulnerabilities across open-source dependencies and third-party service providers, owning risk assessment, mitigation, and remediation