VP, Chief Information Security Officer

Title: VP, Chief Information Security Officer Department: Information Security

Bargaining Unit: NBU Grade: N/A

Position Type: Exempt Hours per Week: 40

Position Summary

The VP, Chief Information Security Officer, (CISO) is responsible for maintaining and enhancing an enterprise information security management program to ensure that information assets are adequately protected. As the designated HIPAA Security Officer, this position is responsible for creating, implementing, and enforcing a security program that focuses on the administrative, physical, technical and organization safeguards per the HIPAA security rule.

"Has minimum necessary access to Protected Health Information (PHI) and Personally Identifiable Information (PII) by Job Description/Role."

Key Duties and Responsibilities

• Responsible for identifying, evaluating, and reporting on information security risks in a manner that meets compliance and regulatory requirements.
• Aligns companies' enterprise risk posture with compliance and regulatory requirements.
• Proactively partner with business units and IT functional areas to implement practices that meet defined policies and standards for information security.
• Serves as the process owner of all assurance activities related to the availability, integrity and confidentiality of patient, employee, and corporate information in compliance with the organization's information security policies
• Collaborates with executive management to determine acceptable levels of risk for the organization
• Internal consultant to organizational leadership regarding cybersecurity awareness and education.
• Identify and prioritize IT Security projects based on business needs and available resources.
• Monitor and report on key performance indicators (KPIs) related to IT Security.
• Conducts risk and vulnerability assessments at the network, systems, and application level.
• Ensures that information system changes are evaluated and implemented as required.
• Responds to Security Information Gathering Questionnaire (SIG-Q) from clients and related to new business activities.
• Manages a team of IT security professionals who are tasked with operating and maintaining all enterprise-wide security systems.
• Prepares documentation such as System Security Plans (SSP), Security Assessment Reports (SAR), and Plan of Action and Milestones (POA&Ms) to ensure compliance with Government security policies, procedures, and requirement
• Ensures process alignment with evolving audit and regulatory requirements
• Performs other duties as assigned

Minimum Qualifications

• Bachelor's degree in a computer science, information systems or engineering and 10 years of professional IT experience and 6 years in IT management and IT security systems

Or

• Associate degree in computer science, information systems or engineering and 12 years of professional IT experience and 6 years in IT management and IT security systems
• Highly knowledgeable about the business environment and ensure that information systems are maintained in a fully secure mode
• Advanced knowledge of established internal and external IT industry security standards, current practices, and methodologies as well as advanced analytical and problem-solving skills
• Ability to drive operational excellence through people, process, and tools
• Strong technical background with ability to lead and direct activities of high-level technical staff and consultants across broad spectrum of data center technologies
• Ability to foster a culture of collaboration, accountability, and continuous learning
• Problem solver who can lead team through crisis situations through rational approach, mature judgment, and clear coordination of tasks.
• Ability to collaboratively work with program colleagues to implement strategic program objectives
• Broad exposure to varying technologies and IT methodologies as well as metrics
• Ability to listen, observe, and inquire to understand how things work today and to identify opportunities for improvement
• Knowledgeable expert in regulated systems (HIPAA) and related audits
• Excellent verbal and written communication skills, including interpersonal and presentation skills.
• Ability to communicate effectively with all levels of an organization and build strong working relationships
• Strong decision-making, project management, and organizational skills with the ability t