The Opportunity

This health system is uniquely positioned as an internationally renowned hospital and research organization. Over the last several years, the organization has initiated a significant digital transformation across the organization in alignment with the Chief Executive Officer and the health system’s multi-year strategic plan. This includes a wide array of initiatives centered around the technology-enablement of world class employee and patient experience, operational efficiency and excellence, systems modernization, automation, AI, external partnerships, and broad innovation. This transformation has significant information security implications, as does the heightened threat landscape in an age of AI.

As the health system continues to transform healthcare, it strives to revolutionize its security program to protect its assets and support its world-class health system strategy. The Senior Director of Information Security will lead and modernize security engineering and operations (cyber defense), ensuring continuous improvement, risk mitigation, and robust layers of defense.

This role is responsible for the strategic and operational management of the organization’s security engineering and cyber defense programs. The Senior Director oversees the management of security operations services, including incident response, vulnerability management, threat hunting, and overall program development within the enterprise. A key responsibility is the continuous evaluation of evolving threats, staying abreast of security technologies, and modernizing layers of defense. The role acts as a security liaison between technology, business, research, and clinical verticals to advance security culture and achieve alignment for strategy and security posture. Additionally, the health system is partnering with a leading managed security services organization, transitioning to a next generation, hybrid SOC model imminently. This new leader will spearhead this ongoing initiative, including the decommissioning of legacy systems in 2026.

The Senior Director is a critical leadership position reporting directly to the Chief Information Security Officer and is a trusted advisor to the Digital Technology Leadership team, as well as key stakeholders throughout the organization.

Key Responsibilities

The Senior Director of Information Security will have a broad set of responsibilities that will encompass the following:

Lead and continuously improve the health system's approach to security monitoring, logging and incident response, ensuring regular oversight, risk evaluation, metrics, and reporting focused on process improvement, tackling evolving threats and focusing on automation and emerging technologies (e.g., artificial intelligence) for continuous improvement
Lead and manage a world-class, 24/7 Security Operations Center (SOC), encompassing resources and technologies in a hybrid, matrixed team.
Ensure comprehensive metric analysis, reporting, and a dashboard view of security across the health system, leveraging insights from SIEM, MSSP, XDR, and other technologies.
Spearhead the implementation and evolution of next-generation security operations technologies, processes, and best practices.
Continuously refine SOC processes to establish standardized playbooks and defined response scenarios
Foster engineering excellence, creative solutions and strategically drive modernization efforts by staying informed of and leveraging new technologies to continuously improve layers of defense, mitigate risk and enhance security operations services
Establish a culture of continuous improvement through development of frequent service and tabletop reviews/exercises focused on best practices, lessons learned and root cause analysis with the intention of refining processes and playbooks, informing better engineering designs, and delivering a more efficient, secure service while reducing key response metrics
Cultivate a world-class operational workforce through the continuous evaluation of skills and capabilities, and the use of ongoing training to ensure readiness to accommodate an evolving security and technology landscape
Develop strategies for the workforce optimization that achieve improvement both in service delivery outcomes and engagement
Oversee and manage vendors partners to deliver top-tier security services; looking ahead to develop and implement next generation of services with a continuous improvement mindset
Manage the budget for the security program and cross-functional security services, while promoting a financial stewardship approach to solutions and services
Develop and execute robust processes, procedures, and frameworks for security program services, while cultivating relationships with enterprise stakeholders, advocating for a security-first mindset, providing trusted advisory services, and supporting the health system’s mission and Strategy
Have pulse on threat landscape, industry trends to position the health system optimally and adopt innovations to reduce risks and enhance efficiency
Develop strong, collaborative relationships within DTS, administrative, business, research, operations, technology and application leaders across the health system to drive collective security health, cyber judgment, change management, risk action plans and response plans as needed
Stay informed regarding regulations, applicable laws, and security frameworks; understanding the implications for the health system’s business and security program, and develop strategies to ensure program alignment

Professional Experience/Qualifications

The Senior Director will be an innovative leader with strong technical acumen and outstanding communication skills, with the natural ability to interface and influence effectively across the health system. Healthcare experience and more specifically in large health systems is strongly preferred. Regardless of industry background, the Senior Director must be an innovative, self-starting, collaborative, and thoughtful leader with proven experience navigating a complex, scaled environment and drive meaningful, technology-driven transformation.

The following experience and skills are critical to success:

At least 10 years of experience within Information Security, Cyber Security, Risk Management, and Information Technology, or industry focusing on control environment.
At least five (5) years of experience in a technology leadership capacity.
Experience in managing security, operations and technology teams.
Security Operations Center development and management.
Healthcare environment, changes and emerging trends in healthcare industry, and understanding of healthcare applications, systems and processes desired.
Demonstrated security operations, standards, and technology life cycle knowledge and experience.
Knowledge and high proficiency in relevant legal and regulatory requirements, including but not limited to, Health Insurance Portability and Accountability Act (HIPAA), Health Information Technology for Economic and Clinical Health (HITECH) Act, Payment Card Industry Data Security Standards (PCI DSS).
Knowledge and high proficiency with various security frameworks.
Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate security and risk-related concepts to technical and nontechnical audiences.

Information Security Requirements:

Understand and comply with all enterprise and IS departmental information security policies, procedures and standards.
Support the integration of information security in the development, design, and implementation of Hospital Technology Resources that process, transmit, or store health system information.
Support all compliance activities related to state, federal regulatory requirements, healthcare accreditation standards, and all other applicable regulations that govern the use and disclosure of patient, financial, or other confidential information.

Education & Certification

A bachelor’s degree in computer science, information technology, or a similar field is required, an advanced degree in a related field is preferred. The following certifications are preferred:

Certified Information Systems Security Professional
Certified Information Security Manager (CISM)
Certified in Risk and Information Systems Control (CRISC)
HealthCare Information Security and Privacy Practitioner (HCISPP)

Confidential Company

New Jobs

Senior Director, Information Security