Chief Information Officer

Company Description Genomai builds medical AI assistants for cancer care. Our assistants help oncology teams and patients work through complex clinical information, so people get the right care sooner.
We handle some of the most sensitive data there is: genomic, clinical and personal health information from people facing cancer. Trust is the product. Security, privacy and responsible AI are not back-office functions here; they are how we earn the right to operate.
Role Description Genomai is hiring a Chief Information Officer to build and own the technology, security and compliance foundation that makes our medical AI assistants trustworthy in cancer care. Your main objective is regulatory compliance and support for hospitals. You will lead SOC 2 and HIPAA readiness, govern how patient data and AI models are used, and run the IT organization that supports clinicians, patients and our own team.
This is a hands-on executive role for someone who wants to change how cancer care is delivered, not only protect systems. Every control you put in place directly determines whether health systems and oncology practices can safely adopt our product.
This is a hard problem at an early-stage startup. We are looking for someone who takes it on because they believe it is the right thing to do and want to change cancer care for the better. Startup life brings real financial uncertainty, so we are looking for someone who is financially prepared for that.
Key Responsibilities:
Security and compliance
• Own and drive SOC 2 Type I and Type II readiness and audits, including control design, evidence collection, auditor management and remediation.
• Build and maintain a HIPAA compliance program: Privacy and Security Rule safeguards, risk assessments, policies, workforce training, breach response, and Business Associate Agreements (BAAs) with customers and vendors.
• Establish a formal information security management program with clear policies, access controls, encryption, logging, vulnerability management, and incident response.
• Serve as the executive point of contact for customer security reviews, questionnaires and due diligence from health systems and oncology practices.
• Partner with legal counsel on state privacy laws, data-use agreements and other healthcare regulations that apply to our work.
Regulatory engagement
• Act as Genomai’s primary technical and compliance contact with regulators and oversight bodies, including HHS Office for Civil Rights (OCR), the FDA, ONC and state health and privacy authorities.
• Lead responses to regulatory inquiries, audits and investigations, and coordinate any required breach notifications to regulators and affected parties.
• Monitor changes in healthcare, privacy and AI regulation, translate them into practical requirements for product and engineering, and brief the CEO and board.
• Prepare the documentation regulators and hospital compliance teams expect: risk analyses, policies, audit trails, validation records and evidence of controls.
• Work with legal counsel and clinical leaders to determine when product features may fall under FDA oversight, and engage regulators early when they do.
AI governance and data stewardship
• Define how PHI and genomic data are collected, stored, de-identified and used, including in model training, evaluation and production.
• Set up governance for medical AI assistants: model risk review, validation and monitoring, audit trails, human oversight, and documentation for clinical and regulatory stakeholders.
Technology and IT leadership
• Lead technology strategy, cloud architecture and infrastructure for a secure, reliable, scalable platform.
• Integrate with EHRs and clinical systems using standards such as HL7 and FHIR, with security and interoperability designed in.
• Manage IT operations, vendor selection, business continuity and disaster recovery.
• Own the technology budget, build and mentor the team, and report on risk and progress to the CEO and board.
Qualifications:
Required
• 10+ years in IT, security or technology leadership, with at least 5 years at director level or above.
• Led at least one organization through a SOC 2 audit (Type II strongly preferred) and maintained an active HIPAA compliance program.
• Direct experience protecting PHI in a healthcare, health tech or life sciences setting.
• Working knowledge of cloud security (AWS, Azure or GCP), identity and access management, encryption, and incident response.
• Experience handling customer security reviews and BAAs with health systems or other regulated buyers.
• Experience working directly with regulators, such as responding to OCR or FDA inquiries or audits, and explaining technical controls to non-technical reviewers.
• Track record of building teams and communicating risk clearly to executives, boards and customers.
Preferred
• Experience in oncology, genomics or clinical research environments.
• Experience governing AI or machine learning systems that use sensitive data.
• Familiarity with HITRUST, ISO 27001, NIST frameworks, 21 CFR Part 11 or FDA guidance on software and AI as a medical device.
• Experience with EHR integration, HL7 and FHIR.
• Relevant credentials such as CISSP, CISM, CISA, CCSP or HCISPP.
• Startup or high-growth experience, comfortable building programs from the ground up.
Who we are looking for:
We want a CIO who is personally driven to change cancer care. You may have seen cancer up close through your own family, a patient, or your own work, and you want your career to move the needle for people going through it.
• Mission first. You can explain why this work matters to you, and it shows in how you make decisions.
• Enabler, not gatekeeper. You build compliance that lets clinicians and patients move faster and safer, rather than slowing the product down.
• Builder. You are comfortable creating programs, policies and teams from scratch, and doing the work yourself when needed.
• Clear communicator. You can explain risk to a CEO, a board, a regulator, a hospital CISO and a non-technical clinician with equal credibility.
• Principled on patient data. You hold a high bar for privacy, consent and responsible AI, even when no one is checking.

Work arrangement
Yes