Senior Director, Zero Trust and Identity Security

Position Summary This position leads the strategic development, implementation, and ongoing management of the organization's zero trust security framework. The role drives transformational security initiatives across network infrastructure, identity and access management, data protection, and configuration management domains. It includes influencing the vision and strategy of Banner’s cybersecurity, staying current on the latest technology trends, understanding market changes and business needs, and working with senior leadership to develop and drive the direction. Partners and collaborates with other security and IT leaders to develop and drive strategies, work on special projects, and solve complex security challenges facing the organization. Core Functions Develops and executes comprehensive zero trust strategy aligned with organizational business objectives and risk tolerance; establishes roadmap for zero trust maturity progression across all security domains; provides executive leadership on security architecture decisions and investments; collaborates with C‑suite and business unit leaders to integrate zero trust principles into digital transformation initiatives; defines success metrics and KPIs for zero trust implementation and effectiveness; supports and promotes security governance and ensures security architectures are aligned to business priority, comply with reference architecture standards, policy and regulatory requirements; ensures Key Performance Indicators are established and tracked in all levels of work effort. Designs and implements micro‑segmentation strategies to minimize lateral movement and contain potential breaches; leads deployment and optimization of Zscaler cloud security platform for secure internet and SaaS access; architects zero trust network access (ZTNA) solutions replacing traditional VPN infrastructure; oversees network security policies, enforcement mechanisms, and continuous monitoring; ensures secure connectivity for remote workforce, partners, and third‑party access. Establishes identity‑centric security controls as the foundation of zero trust architecture; implements adaptive authentication, multi‑factor authentication (MFA), and risk‑based access policies; leads privileged access management (PAM) and just‑in‑time (JIT) access initiatives; drives identity governance programs including access certification and lifecycle management; integrates IAM with SIEM/SOAR platforms for threat detection and automated response. Develops data classification framework and implements appropriate protection controls; deploys data loss prevention (DLP), encryption, and rights management solutions; establishes data access policies based on least privilege and need‑to‑know principles; implements cloud access security broker (CASB) technologies for SaaS data protection; ensures compliance with data privacy regulations (GDPR, CCPA, HIPAA, etc.). Establishes security configuration baselines and hardening standards across all technology platforms; implements infrastructure as code (IaC) with embedded security controls; leads vulnerability management and patch management programs; deploys configuration monitoring and drift detection capabilities; ensures secure DevSecOps practices and CI/CD pipeline security. Builds, mentors, and leads high‑performing security engineering and architecture teams in a fully remote environment; fosters culture of continuous learning and security innovation; develops talent pipeline and succession planning for critical security roles; collaborates with HR on security awareness training and culture initiatives; creates inclusive remote work culture with strong team cohesion across distributed workforce. Ensures zero trust implementation meets regulatory and compliance requirements; establishes security policies, standards, and procedures aligned with industry frameworks (NIST, ISO 27001); coordinates with audit, risk, and compliance teams on security assessments; manages vendor relationships and third‑party security assessments. Analyzes business and IT security environment to detect critical deficiencies and/or redundancies and recommends solutions for improvement; documents current state security architecture, integrates new security solutions into existing systems and deploys solutions that meet emerging business security needs. Serves as a credible expert advisor to peers and senior and executive leadership on the appropriateness of current and future security technologies based on the highest level of Total Cost of Ownership, Return on Investment, and strategic value to the business. Minimum Qualifications Requires Master's degree in Cybersecurity, Information Security, Information Systems, Computer Science, or related field, or equivalent of education and work experience. Requires ten years of current and progressive experience in information security and cybersecurity leadership, including five plus years in senior leadership roles managing enterprise security programs. Requires proven track record implementing protective technology in complex enterprise environments; extensive hands‑on experience with Zscaler or similar cloud security platforms; deep expertise in network segmentation, microsegmentation, and software‑defined perimeter technologies; strong background in IAM platforms (Okta, Azure AD, Ping Identity, SailPoint, CyberArk); experience with data security technologies (DLP, CASB, encryption, tokenization); demonstrated success with configuration management and infrastructure as code tools. Requires proven ability to lead and manage distributed remote teams effectively. Requires expert knowledge of zero trust principles and frameworks (NIST SP 800‑207, Forrester, Gartner); advanced understanding of network protocols, architectures, and security controls; proficiency with cloud platforms (AWS, Azure, GCP) and cloud‑native security; strong knowledge of identity protocols (SAML, OAuth, OIDC, Kerberos, LDAP); familiarity with SIEM, SOAR, EDR, and security analytics platforms; understanding of DevSecOps practices and security automation. Requires proficient understanding of regulatory and compliance mandates, including but not limited to HIPAA, HITECH, PCI, Sarbanes‑Oxley, GDPR, CCPA, and knowledge of compliance frameworks (SOC 2, ISO 27001, NIST CSF, CIS Controls). Requires technical project experience designing, developing, integrating, and implementing solutions to resolve complex technical and business issues. This position may require off‑site travel for annual team gatherings, conferences, or critical vendor meetings. As is typical in this industry, variable shifts or on‑call hours and responding to off‑hour paging may be required. This position requires on‑call availability for security incidents and escalations. Preferred Qualifications CISSP (Certified Information Systems Security Professional) CISM (Certified Information Security Manager) CCSP (Certified Cloud Security Professional) CISA (Certified Information Systems Auditor) Vendor‑specific certifications (Zscaler, cloud platforms, IAM solutions) Additional related education and/or experience preferred. EEO Statement EEO/Disabled/Veterans ( Banner Health supports a drug‑free work environment. Privacy Policy Privacy Policy ( Equal Opportunity Banner Health complies with applicable federal and state laws and does not discriminate based on race, color, national origin, religion, sex, sexual orientation, gender identity or expression, age, or disability. #J-18808-Ljbffr Banner Health