Chief Information Security Officer

Job Title

System Director, Information Security (CISO)

Reports to

SVP, Chief Information & Digital Officer

Department

Information Security

Last Reviewed

August 2026

Vision

Creating America’s healthiest community, together.

Mission

In the spirit of love and compassion, better health, better care, better value

Values

Accountability, Caring and Teamwork

Department Summary

The St. Charles Health System’s Information Security department identifies, assesses, reports, and helps to mitigate technical, physical, and administrative risks to St. Charles’ regulated and confidential information.

Position Overview

The System Director Information Security (CISO) collaborates internally and externally to identify, assess, report, and help mitigate risks to St. Charles’ physical and digital regulated and confidential information in alignment with business goals and objectives. This role leads the information security department and partners closely with IT, Privacy, Compliance, Internal Audit, HR, Legal, and other departments. The CISO develops strategy, policy, and oversees information security operations (e.g., network monitoring, threat intelligence, vulnerability management, penetration testing, data loss prevention, incident response, advisory services), third‑party risk managing, e‑Discovery, information security risk management, awareness and education, program management, and governance. The CISO has demonstrated experience with the technical, administrative, and regulatory requirements and best practices relating to information security, privacy, and healthcare operations. This position directly manages caregivers in the information security department.

ESSENTIAL FUNCTIONS AND DUTIES

• Develops, implements, and oversees a strategic, enterprise‑wide information security program to ensure the integrity, confidentiality, and availability of St. Charles’ regulated and confidential information and systems.
• Identifies, evaluates, and reports on information security risks in a manner that meets compliance and regulatory requirements and aligns with the organization’s overall risk posture.
• Establishes and facilitates information security governance through leadership and active participation in organizational governance bodies, including data governance, external data governance, technology governance, and safety governance committees.
• Reports on the status of identified information security risks, provides regular updates on the evolving threat landscape, and secures executive approval for strategic initiatives to reduce St. Charles’ risk exposure.
• Develops, maintains, and publishes current information security policies, standards, procedures, and guidelines.
• Oversees enterprise information security risk management and mitigation activities to ensure timely and effective remediation.
• Collaborates with executive leadership to define acceptable levels of information security risk and ensures alignment with organizational objectives.
• Partners with the System Privacy Officer to conduct risk assessments and evaluations related to HIPAA Privacy and Security Rule compliance and the Health Industry Cybersecurity Practices.
• Establishes and oversees cybersecurity risk frameworks specifically governing Internet of Medical Things (IoMT) devices, clinical networks, and biomedical integration.
• Drives the adoption and continuous maturity of enterprise security frameworks, aligning operations with the NIST Cybersecurity Framework (CSF), NIST AI Risk Management Framework, and HITRUST standards.
• Leads and directs a dedicated technical security team responsible for executing the following core operational functions: Security Operations & Incident Response (SOC): 24/7/365 security monitoring, threat hunting, log aggregation, and event correlation using SIEM/SOAR platforms. Rapid triage, containment, escalation, and post‑incident root‑cause analysis for security events across network, endpoint, and cloud environments.
• Engineering & Architecture Implementation: Design, deployment, and ongoing administration of Endpoint Detection & Response (EDR/XDR). Identity & Access Management (IAM) technical oversight, including privileged access management (PAM), multi‑factor authentication (MFA), and directory service security controls.
• Vulnerability Management & Offensive Security: Continuous vulnerability scanning, patch verification, and risk‑prioritized remediation tracking across clinical, enterprise, and infrastructure assets. Coordination and execution of internal/external penetration testing, red teaming exercises, and social engineering scenarios.
• Data Loss Prevention (DLP) & Technical Privacy Controls: Configuration and management of DLP agents, email security gateways, encryption tools, and data classification mechanisms to safeguard Protected Health Information (PHI) and corporate data.
• Medical Device & Endpoint Security: Technical discovery, isolation, and security patching for biomedical equipment, Internet of Medical Things (IoMT) hardware, and clinical workstation configurations.
• Designs, implements, and manages organization‑wide information security awareness and training programs for employees, contractors, and authorized system users.
• Works closely with business units to facilitate information security risk assessment and management processes, engaging stakeholders across the organization to identify and manage residual risk.
• Coordinates with the architecture team members to ensure security controls and strategies are aligned with enterprise architecture and technology roadmaps.
• Defines and oversees the information security risk assessment process, including internal reporting and governance of remediation efforts for identified findings.
• Leads the organizational response to information security incidents and events to protect St. Charles’ assets, intellectual property, regulated data, and organizational reputation.
• Supports Human Resources, Legal, Compliance, and Privacy functions with internal investigations, regulatory inquiries, audits, and other investigative activities as required.
• Monitors the external threat environment for emerging risks and vulnerabilities and advises executive leadership and stakeholders on appropriate response strategies.
• Responsible for budget development, regular monitoring, accountability and meeting all operational targets for all areas within span of control.
• Hires, directs, coaches, and monitors the performance of all direct reports, to develop and maintain a high‑performance team that meets organizational and department goals.
• Monitors and ensures all direct reports are current with compliance and safety requirements.
• Implements and manages all organizational safety directives and goals.
• Provides and oversees team’s delivery of customer service in a manner that promotes goodwill, is timely, efficient, and accurate.
• Collaborates with teams to review processes and identify/implement opportunities for improvements, applying Lean principles, concepts, and tools.
• Supports the vision, mission, and values of the organization in all respects.
• Supports the Lean principles of continuous improvement with energy and enthusiasm, functioning as a champion of change.
• Provides and maintains a safe environment for caregivers, patients, and guests.
• Conducts all activities with the highest standards of professionalism and confidentiality.
• Complies with all applicable laws, regulations, policies, and procedures, supporting the organization’s corporate integrity efforts by acting in an ethical and appropriate manner, reporting known or suspected violation of applicable rules, and cooperating fully with all organizational investigations and proceedings.
• May perform additional duties of similar complexity within the organization, as required or assigned.

Education

• Required: Bachelor’s degree in information technology, information security, or related field.
• Preferred: Master’s degree in a related field.

Licensure / Certification / Registration

• Required: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), or other similar credential(s).
• Preferred: Multiple relevant industry certifications.

Experience

• Required: Minimum of seven (7) years of information security experience.
• Minimum of two (2) years leading and managing information security programs and leadership experience in a regulated environment (preferably healthcare).
• Preferred Experience: Comprehensive cybersecurity leadership spanning technical operations, risk and compliance, governance and frameworks, privacy and regulation, cloud and emerging technologies.

Personal Protective Equipment

Must be able to wear appropriate Personal Protective Equipment (PPE) required to perform the job safely.

Additional Position Information

Travel

Must be able to travel to business functions/trainings/meetings and all SCHS worksites.

Physical Requirements

• Continually (75% or more): Use of clear and audible speaking voice and the ability to hear normal speech level.
• Frequently (50%): Sitting, standing, walking, lifting 1-10 pounds, keyboard operation.
• Occasionally (25%): Bending, climbing stairs, reaching overhead, carrying/pushing, or pulling 1-10 pounds, grasping/squeezing.
• Rarely (10%): Stooping/kneeling/crouching, lifting, carrying, pushing, or pulling 25-50 pounds, ability to hear whispered speech level.

Exposure to Elemental Factors

Never (0%): Heat, cold, wet/slippery area, noise, dust, vibration, chemical solution, uneven surface.

Blood‑Borne Pathogen (BBP) Exposure Category

No Risk for Exposure to BBP.

Schedule Weekly Hours

40

Caregiver Type

Regular Shift: First Shift (United States of America)

Is Exempt Position?

Yes

Job Family

DIRECTOR

Scheduled Days of the Week

Monday-Friday

Shift Start & End Time

8:00am - 5:00pm

About the Organization

St. Charles Health System is a private, nonprofit organization, dedicated to providing high‑quality care and the latest in health care technology to the communities it serves. Headquartered in Bend, Ore., St. Charles is an integrated delivery system, with a strong focus on population health, that provides a full range of evidence‑based health care services within a 32,000‑square‑mile area in Central and Eastern Oregon. The health system owns and operates a trauma level II, tertiary referral center in Bend, a trauma level III, type B rural hospital in Redmond, and trauma level IV critical access hospitals in both Prineville and Madras. As the largest employer in Central Oregon, St. Charles Health System and St. Charles Medical Group care for our communities in more than two dozen outpatient clinics and in more than 20 specialty areas of medicine.