Chief Information Security Officer

Company Description

Mark Cuban Cost Plus Drug Company, PBC, is committed to transforming the pharmaceutical industry by offering medicines at fixed, transparent profit margins, making them affordable for patients underserved by current market and regulatory systems. Our mission is to mitigate unnecessary drug shortages in the United States and improve access to essential medications. By reshaping the way medicines are produced and sold, we strive to deliver cost-effective solutions directly to consumers. Join us in our mission to make healthcare more accessible and equitable for all.

Role Description

The Chief Information Security Officer (CISO) is responsible for establishing, leading, and executing the enterprise-wide information security strategy to protect MCCPDC’s digital assets, AI driven technology platforms, data systems, and regulated operations. The CISO will build and oversee a comprehensive cybersecurity program aligned with industry best practices, FDA expectations, and organizational risk tolerance. This executive leader will partner with Technology, Quality, Regulatory, Operations, and Legal to maintain a secure, resilient, and compliant environment.

Qualifications

Strategic Leadership

• Develop and execute the enterprise cybersecurity strategy with an integrated trust management platform • Establish information security governance, policies, and risk frameworks (US Data Privacy, HIPAA, SOC 2). • Create governance frameworks for secure management of AI/ML

• Report security posture, risks, and incidents to the CEO and Board.

Cybersecurity Operations

• Oversee security monitoring, threat intelligence, and incident response

• Manage vulnerability management, penetration testing, and remediation activities.

• Lead digital risk assessments for critical systems (ERP, QMS, LIMS, 503B systems, distribution platforms).

Regulatory & Compliance

• Ensure alignment with FDA, HIPAA, NIST, SOC-2 where applicable.

• Partner with Quality & Regulatory to safeguard data integrity in GMP-regulated systems.

Risk & Governance

• Own enterprise risk management for technology/cybersecurity.

• Conduct annual and ongoing security risk assessments.

• Oversee business continuity/disaster recovery planning and execution for cybersecurity incidents.

Vendor Oversight

• Utilize our trust management platform for third-party security, vendor assessments, external audits, policy management, and automation