Manager, Cybersecurity (Detections, Threat Intelligence, RedTeam/Penetration Testing)

We are so glad you are interested in joining Sutter Health!

Organization:

SHSO-Sutter Health System Office-Valley

Position Overview:

We are seeking an experienced Cybersecurity Manager to lead and oversee Threat Detection, Threat Intelligence, and Red Team/Penetration Testing for our healthcare organization. This critical role will be responsible for ensuring the security of our systems, protecting patient data, and proactively identifying and mitigating cyber threats. The ideal candidate will have a strong background in security operations, offensive and defensive security, and cyber threat intelligence with experience in managing teams in a complex healthcare environment.

Key Responsibilities:
Threat Detection:
Implement advanced detection methodologies to identify and mitigate security incidents.
Collaborate with incident response teams to investigate security events and improve response capabilities.

Threat Intelligence & Cyber Risk Analysis:
Develop and manage cyber threat intelligence programs to anticipate and counter emerging threats.
Analyze threat actor behaviors, TTPs (Tactics, Techniques, and Procedures), and indicators of compromise (IOCs) to strengthen security defenses.
Work with compliance and risk teams to align intelligence efforts with healthcare-specific regulatory requirements (e.g., HIPAA, HITECH).

Red Team & Penetration Testing:
Lead offensive security operations, including penetration testing, adversary simulation, and vulnerability assessments.
Oversee Red Team engagements to test and improve security resilience.
Identify security gaps and collaborate with IT and security teams to remediate vulnerabilities.

Job Description:

EDUCATION:
Equivalent experience will be accepted in lieu of the required degree or diploma.

• Bachelor's: Business, Cybersecurity, Computer Science, Information Technology/Security, Risk Management, or related field or equivalent education/experience

CERTIFICATION & LICENSURE:

• CISSP-Certified Information Systems Security Professional within 1 Year of hire

TYPICAL EXPERIENCE:

• 8 years recent relevant experience

• Cybersecurity Expertise – Experience in threat modeling, offensive security, or detection engineering, with 2+ years in a leadership role managing technical security teams.

• Threat Detection & Adversary Tactics – Deep understanding of adversary TTPs (MITRE ATT&CK), developing threat models, and creating effective detection rules.

• Technical Proficiency – Hands-on experience with SIEM, EDR, and threat hunting tools, plus strong scripting/programming skills (Python, PowerShell); familiarity with automated testing and red team methodologies.

• Leadership & Collaboration – Proven ability to lead technical teams, foster collaboration, and provide constructive feedback while driving security initiatives.

• Communication & Project Management – Skilled at conveying complex technical details to executives and business partners, with strong project management focus on timely delivery and measurable security improvements.

SKILLS AND KNOWLEDGE:

• Detailed understanding of the anatomy of an attack and the lifecycle of a network threat and network vulnerability exploitation in a healthcare environment, especially data movement in a large healthcare system.

• Technical skills in planning, administration, and management of information systems; operational and technical security controls; and security risk analysis and management, including end point security controls, such as access control lists (acls), host intrusion prevention system (hips), registry, logging, and forensics.

• Comprehensive knowledge of end point security technologies (Antivirus, Forensics, Anti-malware, HIPS), data loss prevention (DLP) methodologies, DLP technologies, current information security trends and practices including security processes, methods, and procedures.

• Thorough knowledge of software, hardware, databases, networks, firewalls, encryption, and other systems security devices, including a good understanding of end point operating systems (Windows, Unix, and Linux), internet technologies such as Domain Name System (DNS), routing, Simple Mail Transfer Protocol (SMTP), Hypertext Transfer Protocol (HTTP), Dynamic Host Configuration Protocol (DHCP), and File Transfer Protocol (FTP), and familiarity in a command line environment.

• Expert knowledge of state and federal information services (IS) security and privacy-related regulatory requirements and laws.

• Developed understanding of National Institute of Standards and Technology (NIST), Health In