Director, Cybersecurity Risk Management

Thank you for your interest in working for our Company. Recruiting the right talent is crucial to our goals. On April 1, 2024, 3M Healthcare underwent a corporate spin-off leading to the creation of a new company named Solventum. We are still in the process of updating our Careers Page and applicant documents, which currently have 3M branding. Please bear with us. In the interim, our Privacy Policy here: https://www.solventum.com/en-us/home/legal/website-privacy-statement/applicant-privacy/ continues to apply to any personal information you submit, and the 3M-branded positions listed on our Careers Page are for Solventum positions. As it was with 3M, at Solventum all qualified applicants will receive consideration for employment without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.

Job Description:

Director, Cybersecurity Risk Managemen

At Solventum, we enable better, smarter, safer healthcare to improve lives. As a new company with a long legacy of creating breakthrough solutions for our customers’ toughest challenges, we pioneer game-changing innovations at the intersection of health, material and data science that change patients' lives for the better while enabling healthcare professionals to perform at their best. Because people, and their wellbeing, are at the heart of every scientific advancement we pursue.

We partner closely with the brightest minds in healthcare to ensure that every solution we create melds the latest technology with compassion and empathy. Because at Solventum, we never stop solving for you.

The Impact You’ll Make in this Role

As Director, Cybersecurity Risk Management, you will lead the overall information security risk management program and strategy, providing skilled leadership to build high-performing team(s), and engaging IT and Business leaders across a wide spectrum of projects.  Your collaborative approach and exceptional communication skills will play a significant role in your success, as you engage and support colleagues inside and outside the organization.  As part of this new Healthcare spinoff, you will have the opportunity to create an industry best-practice program that serves as a strategic enabler for the business.   

Responsibilities

• Drive cybersecurity risk management taxonomy and framework/ methodology including implementing an Enterprise Control Framework (ECF) utilizing NIST/HITRUST controls that align with Enterprise Risk Management (ERM) objectives.

• Lead a team that performs risk assessments, and identify, mitigate, and track to closure risks across the enterprise, providing actionable data and recommended solutions to organization leadership.

• Define standardized risk assessment and exception handling processes, including defining what constitutes an exception and the criteria for managing them.

• Develop and execute gold-standard information security governance strategy and program. Drive culture of transparency, integrity, and accountability.

• Focus efforts to support cyber- and business resilience, ensuring the organization is well-prepared to counter risks to continuity of operations.

• Develop the appropriate security checkpoints against software and infrastructure development lifecycles, shifting effort to prevent rework and build security by design into every project.

• Establish a robust Findings & Remediation program that identifies trends in newly discovered risks, provides actionable reporting, identifies root cause, and works collaboratively to reduce inherent risk and technical debt.

• Use expertise to scale programs up and down to meet the current regulatory environment and the risk appetite of the organization.

• Establish and maintain robust data security governance, including creation, classification, retention, retrieval, and disposal of records.

• Monitor regulatory changes and industry standards.

• Coordinate the transfer of information into or out of the firm in compliance with organizational policies. When necessary, ensure the proper execution of destruction orders.

• Implement supporting protocols and processes to ensure statutory, regulatory, ethical and privacy requirements are met for the management of physical and electronic information.

• Support data governance efforts across the organization, including but not limited to data classification, data retention and disposal, data sharing, records management, archiving data, and data privacy. 

Your Skills and Expertise 

To set you up for success in this role from day one, Solventum requires (at a minimum) the following qualific