Head of IT & Cybersecurity

About Eko Health Eko builds AI and digital tools to enable every healthcare provider to more accurately detect heart and lung disease – the leading causes of death globally. Our FDA cleared, industry leading products are used by hundreds of thousands of clinicians on millions of patients around the world. With Eko, clinicians can detect cardiac and pulmonary disease with higher accuracy, diagnose with more confidence, manage treatment effectively, and ultimately give their patients the best care possible. We have strong venture capital backing from investors like Artis Ventures, Questa Capital, Highland Capital, and Mayo Clinic Ventures. Recognized by TIME magazine in 2025 as one of the world’s top healthcare technology companies, Eko is one of the fastest growing digital health companies with products used around the world at some of the most prestigious health systems. We have more than 8 FDA clearances including novel AI algorithms, and we invest heavily in quality clinical research and R&D to build and validate exceptional products for patients we care deeply about. We’ve built a mission driven, high performing, talented, and diverse team of engineers, physicians, PhD’s, creatives, and technologists. We are committed to investing in each other and our mission to ensure all patients have access to high quality care. We are headquartered in Emeryville, California and privately-held with world class investors and partners. Role Summary Eko is hiring a Head of Information Technology & Cybersecurity to own the company's corporate IT operations and cybersecurity program end to end. In this role, you will be the single accountable owner for keeping Eko's internal systems reliable and secure, and for corporate compliance obligations including SOC 2 and related frameworks. This is a corporate-facing role. The security of Eko's product — its FDA-cleared device software and AI platform — is owned by our Product Security team. This role does not set product security strategy; you will serve as a resource to Product Security, executing security testing against that team's pre-defined product security procedures as required. This is a hands-on and highly visible leadership role for someone who can build a program, run it day to day, and represent it credibly to auditors, customers, and executive leadership. Essential Functions: Corporate IT Operations & Infrastructure Own Eko's corporate IT strategy, infrastructure, and day-to-day operations: employee endpoints (MDM), identity and access management (SSO/MFA), corporate network, cloud workplace tools, helpdesk/support, and asset management. Manage software and SaaS procurement, licensing, and lifecycle, including vendor selection and renewal negotiations in partnership with Finance. Own the IT budget and technology roadmap, and build or manage the team (internal hires and/or outsourced providers) responsible for day-to-day IT support. Cybersecurity Program & Governance Design, implement, and continuously mature Eko's corporate cybersecurity program: security policies, endpoint and email security, data loss prevention, identity governance, security awareness training, and incident response planning. Own and maintain the corporate security risk register, and drive remediation of identified gaps with clear ownership and timelines. Act as Eko's primary point of contact for corporate-level security incidents — coordinating investigation, containment, communication, and post-incident review. Compliance & Audit Management Own SOC 2 (Type I/II) end to end: scoping, control design and implementation, evidence collection, and management of the external audit relationship. Own or contribute to other applicable corporate compliance obligations as the company's needs require — for example HIPAA/HITECH administrative and technical safeguards, HITRUST, and relevant privacy regulations (e.g., CCPA, UK/EU GDPR) tied to Eko's customer base and international footprint. Serve as the primary liaison for customer and partner security questionnaires, vendor security due-diligence requests, and audit committee or board reporting on IT/security posture. Maintain the compliance calendar so renewals, audits, and control testing happen on schedule, with no last-minute scrambles. Customer & Health-System Documentation Own the timely delivery of all corporate compliance and security documentation requested by health systems, clinicians, and other customers during sales procurement, vendor risk review, and ongoing account management — including SOC 2 reports, HIPAA/BAA materials, security questionnaires (e.g., SIG, CAIQ), penetration test summaries, and policy attestations. Maintain a current, ready-to-share documentation package so Sales and Customer Success can respond to procurement and security-review requests without delay. Partner with Sales, Customer Success, and Legal to support customer security calls and due-diligence sessions when a technical point of contact is needed. Cross-Functional Collaboration Partner with People/HR on secure onboarding and offboarding, device provisioning, and access provisioning/deprovisioning. Partner with Legal on vendor security reviews and data processing agreements. Partner with Product Security as a testing resource, executing tests against procedures that team defines — see note above on where this role's scope ends. Note: Job duties may change at any time with or without notice. Required Qualifications: Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent practical experience. 10+ years of experience in IT and/or cybersecurity roles, including leadership experience, ideally at a growth-stage company. Experience in a regulated healthcare, digital health, or medical device company, with familiarity with HIPAA/HITECH, HITRUST, or FDA cybersecurity expectations for connected devices. Hands-on experience owning SOC 2 from scoping through audit, including evidence collection and direct management of the external auditor relationship. Strong working knowledge of identity and access management, endpoint management, cloud workplace platforms (e.g., Google Workspace or Microsoft 365), and modern security tooling (EDR, MDM, SSO/IdP, DLP). Track record of building or maturing a security program — policies, a risk register, incident response, and security awareness training — largely from the ground up. Excellent written, verbal, and executive presentation skills, with the ability to translate technical risk for executive and non-technical audiences. Preferred Qualifications: Relevant certification such as CISSP, CISM, or CRISC. Experience supporting compliance needs tied to international expansion (e.g., UK/EU GDPR).