DEPARTMENT
Information Security / Information Technology
REPORTS TO
Chief Technology Officer
EMPLOYMENT TYPE
Full-Time
LOCATION
Remote — must reside in FL, GA, or TX. Candidates local to the Tampa Bay area may be required to work onsite occasionally.
TRAVEL REQUIREMENT
Up to 10%
EDUCATION
Bachelor's degree in Information Security, Computer Science, Information Technology, or a related field, or equivalent professional experience.
ABOUT SIGHTVIEW
Sightview Software LLC provides a suite of industry-leading software specifically geared toward ophthalmology and optometry practices — practice management, surgical, revenue cycle management (RCM), MIPS reporting, and more. Sightview is a one-stop shop for eye care specialists and their patients.
Integrity • Collaboration • Accountability • Resilience • Engagement
JOB SUMMARY
The VP, Information Security & IT Operations is the single accountable executive for Sightview's corporate technology infrastructure and its enterprise information security and privacy program. This role owns two interconnected mandates: (1) ensuring Sightview's internal IT systems, infrastructure, and operations run reliably, securely, and cost-effectively to support the business day-to-day, and (2) building, leading, and continuously maturing the company's cybersecurity, risk, and privacy program to protect the organization, its customers, and its data. The VP owns the security and privacy program, supported by a GRC Manager and Security Team Leads, and partners closely with DevOps, Engineering, and Product to embed security into how Sightview builds and operates.
ESSENTIAL DUTIES & RESPONSIBILITIES
-
Corporate IT Operations & Infrastructure Leadership – 30%
-
Lead day-to-day corporate IT discussions, priorities, and decision-making across infrastructure, end-user computing, and business systems.
-
Own IT project plans and roadmaps, ensuring initiatives are scoped, resourced, sequenced, and delivered on schedule.
-
Serve as the escalation point and approver for IT systems changes, purchase requests, and operational expenses.
-
Oversee corporate network, systems, and infrastructure operations to ensure reliability, availability, and performance at an optimal level.
-
Manage the IT budget: forecasting, vendor contracts, licensing, and expense approvals, ensuring cost-effective use of resources.
-
Partner with department leaders across the business to translate operational needs into IT solutions and support requests.
-
Evaluate, select, and manage relationships with IT vendors, managed service providers, and technology partners.
-
Information Security & Privacy Program Leadership – 60%
-
Own the enterprise cybersecurity program end-to-end, acting as the accountable owner of security and privacy outcomes, supported by the GRC Manager and Security Team Leads.
-
Lead Sightview's SOC 2 Type II and HITRUST programs, including audit readiness, evidence collection, control testing, gap remediation, and ongoing certification maintenance.
-
Develop, maintain, and continuously improve security policies, processes, and standard operating procedures (SOPs) aligned to industry frameworks (e.g., NIST, ISO 27001, HITRUST CSF).
-
Collaborate cross-functionally with DevOps and Engineering/Development teams to embed secure-by-design principles, secure SDLC practices, and security tooling into the development and deployment pipeline.
-
Own the enterprise risk management program: identify, assess, prioritize, track, and report on security and privacy risks to leadership.
-
Lead the third-party and vendor security risk assessment program, ensuring vendors and partners meet Sightview's security and privacy requirements before and during engagement.
-
Own budget decisions for security and privacy application/tooling services (e.g., SIEM, vulnerability management, WAF, endpoint/cloud security tooling, GRC platforms), prioritizing spend against risk and program maturity goals.
-
Operate comfortably within Sightview's AWS infrastructure with deep, hands-on-level familiarity — reviewing CloudTrail logs, firewall rules, and WAF configurations, and asking the right technical questions of engineering/DevOps to confirm infrastructure integrity is maintained.
-
Ensure security operations and network operations run at an optimal level; personally review and question any major red flags, anomalies, or emerging threats.
-
Own the design, deployment, and maturity of the Application Security program in partnership with Engineering and DevOps.
-
Guide, mentor, and develop team members — including onboarding new hires, building team capability, and fostering a culture of security ownership.
-
Lead incident response for security events, coordinating investigation, containment, remediation, and post-incident reporting.
-
Maintain the organization's privacy program in coordination with legal/compliance stakeholders, ensuring data handling practices meet regulatory and contractual obligations.
-
Serve as Sightview's subject matter expert on HIPAA, HITECH, and ONC (Office of the National Coordinator for Health IT) requirements, confidently and accurately answering compliance and security questions from customers, auditors, regulators, and internal stakeholders.
-
Leadership, Governance & Executive Reporting – 10%
-
Report program status, risk posture, and key metrics to executive leadership and, where applicable, the board or audit committee.
-
Set the strategic direction and annual roadmap for both IT operations and the security/privacy program, aligned to business goals.
-
Own and manage the combined IT and security budget, staffing plan, and resource allocation.
-
Represent security and IT operations in customer, auditor, and regulator conversations as needed.
REQUIRED QUALIFICATIONS
-
9-11 years of progressive experience in information security and/or IT leadership, including 3+ years in a senior/executive-level role owning both a security program and IT operations.
-
Demonstrated experience leading organizations through SOC 2 Type II and HITRUST certification and audit cycles.
-
Strong working knowledge of security frameworks (NIST CSF, ISO 27001, HITRUST CSF) and risk management methodologies.
-
Experience partnering with DevOps and Engineering teams on secure SDLC, cloud security, and application security programs.
-
Proven track record managing third-party/vendor risk assessment programs.
-
Experience owning corporate IT infrastructure, end-user computing, and business systems in a growing organization.
-
Strong budget management experience across both IT and security spend, including direct ownership of budget decisions for security and privacy application/tooling services.
-
Excellent stakeholder management and communication skills, with the ability to translate technical risk into business terms for executive audiences.
-
Demonstrated people leadership: hiring, mentoring, and developing security and IT talent.
-
AWS & Cloud Infrastructure Expertise
-
Extensive, hands-on experience operating within AWS infrastructure, with the technical depth to engage directly rather than rely solely on reports from engineering teams.
-
Demonstrated proficiency reading and interpreting AWS CloudTrail logs to investigate activity, trace changes, and identify anomalous or unauthorized behavior.
-
Strong working knowledge of firewall and Web Application Firewall (WAF) configuration, rule sets, and log review.
-
Ability to ask precise, informed technical questions of DevOps and Engineering to validate that infrastructure integrity and security controls remain intact.
-
Regulatory & Compliance Subject Matter Expertise
-
Recognized subject matter expert in HIPAA, HITECH, and ONC (Office of the National Coordinator for Health IT) requirements as they apply to a healthcare SaaS environment.
-
Able to confidently and accurately field compliance and security questions from customers, auditors, regulators, and internal teams without needing to escalate.
PREFERRED QUALIFICATIONS
-
CISSP, CISM, or CRISC
-
HITRUST Certified Practitioner (or equivalent HITRUST assessment experience)
-
AWS Certified Security – Specialty or equivalent AWS security certification
PHYSICAL REQUIREMENTS & WORK ENVIRONMENT
-
Prolonged periods of sitting at a desk and working on a computer
-
Regular use of a keyboard, mouse, and monitor, requiring repetitive hand and wrist motion
-
Ability to communicate clearly by phone, video conference, and in person
-
Ability to read and interpret information on a computer screen and in printed documents
-
Occasional standing, walking, bending, and reaching within an office environment
-
Ability to occasionally lift and move office supplies or equipment weighing up to 15 pounds
COMPENSATION & BENEFITS
The anticipated pay range for this role is $140,000 – $180,000 per year, based on experience, qualifications, location, and internal equity. Actual pay may vary from the posted range.
This role participates in Sightview's management bonus plan, with an annual bonus of 15% of base salary.
Sightview offers a comprehensive benefits package that includes medical, dental, and vision coverage; a 401(k) plan with company match; and a selection of additional voluntary benefits. Eligibility and plan details are provided during onboarding.
BACKGROUND CHECK & DRUG-FREE WORKPLACE
Employment with Sightview is contingent upon successful completion of a pre-employment background check. Sightview also conducts drug testing as a condition of employment. Our screening panel includes marijuana; however, a positive marijuana result alone will not disqualify an applicant from employment.
EQUAL EMPLOYMENT OPPORTUNITY
Sightview Software LLC is an Equal Opportunity Employer. We recruit, hire, train, and promote without regard to race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, genetic information, veteran status, or any other characteristic protected by applicable federal, state, or local law.
REASONABLE ACCOMMODATION
Sightview is committed to providing reasonable accommodations to qualified individuals with disabilities throughout the application and employment process. If you require an accommodation, please contact Human Resources to make your request.
