Chief Architect, Cybersecurity

Lantheus is headquartered in Bedford, Massachusetts with offices in New Jersey, Canada, and Sweden.  For more than 60 years, Lantheus has been instrumental in pioneering the field of medical imaging and has helped physicians enhance patient care with its broad product portfolio. 

Lantheus is an entrepreneurial, agile, growing organization that provides innovative diagnostics, targeted therapeutics, and artificial intelligence (AI) solutions that empower clinicians to find, fight and follow disease.  At Lantheus our purpose and values guide our behaviors in all interactions and play a vital role in creating a dynamic environment that contributes to our success.  Every employee is crucial to our success; we respect one another and act as one knowing that someone’s health is in our hands.  We believe in helping people be their best and are seeking to bring together a diverse group of individuals with different viewpoints and skill sets to be a part of a productive and inclusive team. 

The Chief Architect, Cybersecurity will oversee the strategic and operational aspects of our Security Architecture program to provide support and collaboration with business leaders on matters related to security architecture design and implementation.

This role will report directly to the Chief Information Security Officer and manage the relationships with key IT stakeholders across the organization to support project teams across the enterprise to leverage the cybersecurity program in reaching their goals in a secure manner and to provide measurements of inherent risk for risk-based decision making for the organization.

Responsibilities include, but are not limited to:

• Serve as a point of contact for IT security between business and operational units and the Enterprise Risk Management and Compliance team.
• Establish and provide security architecture guidance to the Change Review Board (CRB)
• Serve as a Subject Matter Resource (SMR) to provide in depth expertise about security principles and ensures controls are included in technical requirements
• Incorporate Security by Design principles to define security architecture requirements and maintain secure architecture standards to support Information Security policies and procedures
• Provide guidance on maintaining compliance with cybersecurity policies and standards through pragmatic solutions and recommendations to meet or exceed security requirements
• Promote IT Security culture within the business and application management teams and build an external network regarding IT Security relevant to the business function
• Define, implement, and document processes for and provides support of Application Security, SSO, Federated ID Management, IAM, Role Based Access Control etc.
• Define, implements, documents processes for and provides support of Data Security model including but not limited to encryption, privacy management, data classification and assigning certain security levels based on classification etc.
• Works closely with IT Infrastructure team to integrate security solutions into infrastructure processes, Business Strategy, and applications development processes
• Perform risk/threat assessments of IT projects and related plans to ensure the appropriate security controls are incorporated into the design and operation of new technologies
• Document and maintain security architecture designs and secure data flows for internal and external API connectivity by third parties
• Ensure Third-Party Risk Assessments (TPRAs) & product implementations are aligned with the Enterprise Security Architecture

Minimum Requirements:

• Bachelor’s or master’s degree in a relevant field of work or equivalent combination of education and work experience 
• 10+ years of experience in cybersecurity and with a minimum of 5 years in security architecture solution design
• 5+ years Management/leadership experience; managing people, projects, budgets, and processes
• Strong understanding of industry standards and regulations including: NIST, SOX, HIPAA, PCI, ISO, GDPR, CCPA, HITRUST, GxP, and others
• Direct experience implementing enterprise-wide security solutions and documenting supporting processes and practices (i.e., solution workflow diagrams, system documentation, playbooks, etc.)
• Strong domain expertise and understanding of following areas:
  • Security architecture
  • Security technologies (e.g., firewalls, security event monitoring, intrusion detection and prevention, malware detection)
  • Data protection
  • Application security/SDLC
  • Cloud security
• Demonstrated ability to build Threat Models and analyze security weaknesses in complex deployments with varying technology stack
• Deep knowledge of architecting mi