Information Security Officer (ISO)

Capital Health is the region's leader in providing progressive, quality patient care with significant investments in our exceptional physicians, nurses and staff, as well as advanced technology. Capital Health is a dynamic health care resource accredited by the DNV that includes two hospitals, an outpatient center, satellite ED, and an expansive network of primary and specialty care. Capital Health Medical Group is made up of more than 600 physicians and other providers who offer primary and specialty care, as well as hospital-based services, to patients throughout the region.

Capital Health recognizes that attracting the best talent is key to our strategy and success as an organization. As a result, we aim for flexibility in structuring competitive compensation offers to ensure we can attract the best candidates.

The listed pay range or pay rate reflects compensation for a full-time equivalent (1.0 FTE) position. Actual compensation may differ depending on assigned hours and position status (e.g., part-time).

Scheduled Weekly Hours:

Position Overview

SUMMARY (Basic Purpose of the Job)

The Information Security Officer (ISO) serves as the executive leader responsible for protecting Capital Health’s digital environment and building organizational resilience against cyber threats. This role defines the organization’s cybersecurity strategy, safeguarding the confidentiality and availability of patient data, clinical systems and connected medical technologies by establishing clear policies and governance that align with healthcare regulations and industry standards. The ISO also acts as a principal advisor to leadership, working across clinical, legal and technical teams to embed security into daily operations and build a culture of digital trust. Additionally, the role oversees risk management and business continuity planning to ensure the organization can defend against emerging threats and quickly resume serving the community in the event of a disruption.

MINIMUM REQUIREMENTS:

Education: Bachelor’s degree in Information Security, Computer Science, Information Technology, Business, Engineering, or related field required. Master’s degree preferred.

Experience: Ten years of progressive experience in cybersecurity, with a proven track record of building and maturing enterprise-level security programs. Direct experience leading security initiatives in healthcare or another highly regulated environment, with a deep understanding of operational needs and regulatory rules. Significant experience architecting and securing complex digital environments – including cloud-native platforms, DevSecOps pipelines, clinical systems and APIs - to ensure safety and security are built into the design from the start. Extensive experience acting as a trusted advisor to executive leadership, boards and governance committees on cyber risk and digital trust. Preferred certifications include: CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), CRISC (Certified in Risk and Information Systems Control), CISA (Certified Information Systems Auditor), HCISPP or healthcare-specific security certification and cloud security certifications (Azure, AWS, or equivalent).

Other Credentials:

Knowledge and Skills: Deep working knowledge of healthcare security standards (HIPAA/HITECH, NIST CSF, ISO 27001) and clinical accreditation expectations (DNV). Specific understanding of securing medical devices and healthcare-specific operational technology (IEC 62443). Strong technical depth in cloud-native systems, DevSecOps, AI governance and the security of internally developed applications. Expert knowledge of the Secure Software Development Lifecycle (SSDLC) and modern application security principles. Advanced understanding of enterprise risk management and the ability to make data-driven, risk-based decisions. Professional proficiency in translating complex technical concepts into clear, actionable reports for executive and board-level presentations.

Mental, Behavioral and Emotional Abilities: A leadership style focused on supporting the clinical mission and ensuring security enables – rather than hinders – patient care. Natural ability to build trust and influence others within a complex, matrixed organization, from clinicians to executives. High level of interpersonal effectiveness and the ability to mentor technical teams to increase their maturity. A proactive drive to modernize and scale security capabilities while balancing innovation with practical operational realities. Proven ability to take ownership of difficult security decisions and remain accountable for the organization’s resilien