Chief Information Security Officer (Camden)

About UsAt Cooper University Health Care, our commitment to providing extraordinary health care begins with our team. Our extraordinary professionals are continuously discovering clinical innovations and enhanced access to the most up-to-date facilities, equipment, technologies and research protocols. We have a commitment to our employees to provide competitive rates and compensation programs. Cooper offers full and part-time employees a comprehensive benefits program, including health, dental, vision, life, disability, and retirement. We also provide attractive working conditions and opportunities for career growth through professional development.Discover why Cooper University Health Care is the employer of choice in South Jersey.Short DescriptionThe CISO will be responsible for implementing and running the enterprise cybersecurity program. That will involve identifying, evaluating and reporting on some or all of legal and regulatory, IT, and cybersecurity risk to information assets, while supporting and advancing business objectives. The CISO position requires a visionary leader with sound knowledge of business management and a working knowledge of cybersecurity technologies covering the corporate network as well as the broader digital ecosystem. The CISO is responsible for establishing and maintaining the cybersecurity program to ensure that information assets and associated technology, applications, systems, infrastructure and processes are adequately protected in the digital ecosystem in which we operate.A key element of the CISO's role is working with executive management to determine acceptable levels of risk for the organization. They will proactively work with business units and ecosystem partners to implement practices that meet agreed-on policies and standards for cybersecurity. The CISO should understand and articulate the impact of cybersecurity on (digital) business and be able to communicate this to the board of directors and other senior stakeholders.The CISO must be knowledgeable about both internal and external business environments and ensure that information systems are maintained in a fully functional and secure mode and are compliant with legal, regulatory and contractual obligations. They serve as the process owner of the appropriate second-line assurance activities not only related to confidentiality, integrity and availability of information owned or processed by the business but extend their expertise to aid the organization in meeting safety, privacy, reliability and resilience requirements. The CISO understands that securing information assets and associated technology, applications, systems and processes in the wider ecosystem in which the organization operates is as important as protecting information within the organization's perimeter.The ideal candidate is a thought leader, a builder of consensus and of bridges between business and technology. They are an integrator of people, process and technology. While the CISO is the leader of the cybersecurity program, they must also be able to coordinate disparate drivers, constraints and personalities, while maintaining objectivity and a strong understanding that cybersecurity is foundational for the organization to deliver on its business goals and objectives. Ultimately, the CISO is a business leader, and should have a track record of competency in the field of cybersecurity and/or risk management, with seven to 10 years of relevant experience, including five years in a significant leadership role. OverviewESTABLISH GOVERNANCE AND BUILD KNOWLEDGEFacilitates a cybersecurity governance structure through the implementation of a hierarchical governance program, including the formation of a cybersecurity steering committee or advisory boardProvides regular reporting on the current status of the cybersecurity program to enterprise risk teams, senior business leaders and the board of directors as part of a strategic enterprise risk management program, thus supporting business outcomesDevelops, socializes and coordinates approval and implementation of security policiesWorks with the vendor management office to ensure that cybersecurity requirements are included in contracts by liaising with vendor management and procurement organizationsDirects the creation of a targeted cybersecurity awareness training program for all employees, contractors and approved system users, and establishes metrics to measure the effectiveness of this security training program for the different audiencesUnderstands and interacts with related disciplines, either directly or through committees, to ensure the consistent application of policies and standards across all technology projects, systems and services, including privacy, risk management, compliance and business continuity managementAdvises on the cyber risk posture of the organization, including the mandatory application of controlsEmbeds Cyber Judgement across a centralized or decentralized or distributed decision making modelOwns the security champion program to mobilize employees in all locationsLEAD THE ORGANIZATIONLeads the cybersecurity function across the company to ensure consistent and high-quality information security management in support of the business goalsDetermines the cybersecurity approach and operating model in consultation with stakeholders and aligned with the risk management approach and compliance monitoring of non-digital risk areasManages the budget for the cybersecurity function, monitoring and reporting discrepanciesManages an effective cybersecurity organization, consisting of direct reports and dotted line reports (such as individuals in business continuity and IT operations). This includes hiring (and conducting background checks), training, staff development, performance management and annual performance reviewsSET THE STRATEGYDevelops a cybersecurity vision and strategy that is aligned to organizational priorities and enables and facilitates the organization's business objectives, and ensures senior stakeholder buy-in and mandateDevelops, implements and monitors a strategic, comprehensive cybersecurity program to ensure appropriate levels of confidentiality, integrity, availability of information assets owned, controlled or/and processed by the organization as well as the meeting of safety, privacy, reliability and resilience requirements as needed.Advises on the identification of non-IT managed IT services in use (citizen IT) and on facilitating a corporate IT onboarding program to bring these services into the scope of the IT function, and apply standard controls and rigor to these services; where this is not possible, ensures that risk is reduced to the appropriate levels and ownership of this cybersecurity risk is clearWorks effectively with business units to facilitate cybersecurity risk assessment and risk management processes, and empowers them to make the right decisions that fall within the risk appetite of their organization.DEVELOP THE FRAMEWORKSEnhances the security posture by adopting a cybersecurity framework that is applicable to the organization: NISTCreates and manages a unified and flexible, risk-based control framework to integrate and normalize the wide variety and ever-changing requirements resulting from global laws, standards and regulationsDevelops and owns a document framework of continuously up-to-date cybersecurity policies, standards and guidelines. Oversees the approval and publication of these cybersecurity policies and practicesCreates a framework for roles and responsibilities with regard to information ownership, classification, accountability and protection of information assetsFacilitates a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitates appropriate resource allocation, and increases the maturity of the cybersecurity, and reviews it with stakeholders at the executive and board levelBUILD THE NETWORK AND COMMUNICATE THE VISIONProvides input for the IT section of the company's code of conductCreates the necessary internal networks among the cybersecurity team and line-of-business executives, corporate compliance, audit, physical security, legal and HR management teams to ensure alignment as requiredBuilds and nurtures external networks consisting of industry peers, ecosystem partners, vendors and other relevant parties to address common trends, findings, incidents and cybersecurity risksLiaises with external agencies, such as law enforcement and other advisory bodies, as necessary, to ensure that the organization maintains a strong security posture and is kept well-abreast of the relevant threats identified by these agenciesLiaises with the enterprise architecture team to build alignment between the security and enterprise (reference) architectures, thus ensuring that cybersecurity requirements are implicit in these architectures and security is built in by designOPERATE THE FUNCTIONCollaborates and liaises with the privacy officer to ensure that privacy requirements are included where applicableDefines and facilitates the processes for cybersecurity risk and for legal and regulatory assessments, including the reporting and oversight of treatment efforts to address negative findingsEnsures that security is embedded in the project delivery process by providing the appropriate cybersecurity policies, practices and guidelinesManages and contains cybersecurity incidents and events to protect corporate IT assets, intellectual property, regulated data and the company's reputationMonitors the external threat environment for emerging threats, and advises relevant stakeholders on the appropriate courses of actionDevelops and oversees effective resilience policies and standards to align with the enterprise resilience program goals, with the realization that components supporting primary business processes may be outside the corporate perimeterCoordinates the development o