Chief Information Security Officer

Chief Information Security Officer (CISO)The Chief Information Security Officer (CISO) is the executive leader responsible for all cybersecurity and data protection needs across HOPCo. This leader is tasked with proactively ensuring all systems, networks, methods of storing and moving data, are secured in a manner that is robust and protects member personal health information and all other sensitive or business confidential information and assets. The CISO will protect HOPCo from "bad actors" seeking to undermine the HOPCo business or access protected data. This leader will stay aware of all new threats, to proactively monitor, detect, and mitigate.This leader will work with HOPCo Compliance to ensure all HOPCo employees understand the role they play in protecting HOPCo assets and data. The CISO is responsible for all security standards, policies, and enforcement across HOPCo. This includes accountability for the security standards enforced with all third parties upon which HOPCo depends. This also includes the security profiles for all clinical sites owned or managed by HOPCo.This leader plays a critical role in making certain HOPCo is prepared to continue to function in the event of a ransomware attack or natural disaster.The CISO is also tasked with gaining and maintaining HiTrust certification for HOPCo and ensuring ongoing compliance with regulatory requirements like HIPAA and GDPR.Essential functions include:Develop and execute on a plan to gain and maintain HiTrust certificationOwn ongoing compliance with data protection regulations like HIPAA and GDPRStay aware and current on all government policies related to data protectionStay aware of the developing cybersecurity threat landscape using regular NIST alerts (or equivalent) and filter noise from actual threats to the HOPCo ecosystemMonitor the HOPCo systems for suspicious activityEstablish cybersecurity policies and protocolsEstablish data privacy policies and protocolsPartner with Compliance to maintain and deliver regular cybersecurity and data privacy training to all employeesEnforce HOPCo cybersecurity and data privacy policies with all third partiesInitiate and sponsor regular cybersecurity audits, including penetration tests, to identify vulnerabilitiesAssess all audit findings, establishing a prioritized path to mitigationReport the state of cybersecurity threats and readiness to the CTO, CEO, and board on a regular basisEstablish dashboards and metrics to monitor current state and improvement over timeSelect and implement appropriate monitoring toolsDevelop an annual budget and business case tied to security investment needsEstablish a plan to protect HOPCo against ransomware attacks and to ensure the business can continue uninterrupted in the event of an attackWork with other IT and business leaders to establish a robust Disaster Recovery Business Continuity PlanManage prioritization and execution priority on all cybersecurity and data privacy workManage MSSP vendors, including the selection and financial arrangement of using vendorsWork with the CTO to manage the security-related budgetHire, manage, and coach security team membersManage security assessments of HOPCo for customers and potential customer auditsEnsure HOPCo Access Management processes and policies are robust and followedEducation:Bachelor's Degree required (Computer Science preferred); CISSP or equivalent security professional certification.Experience:10+ years in various roles leading IT cybersecurity and data privacy teams and processes within healthcareExceptional written and verbal communication skills. Ability to communicate complex technical topics effectively to executive audiences.Experience within a HiTrust certified organization and involvement in ongoing adherenceExperience implementing security programs within complex environmentsExperience directly managing third parties to implement security tools and protocolsDemonstrated experience as successful influential leader across matrixed teamsExperience leading, hiring and coaching a team that includes internal and external team membersRequirements:NoneKnowledge:Expert knowledge and insight into threat vectors, ransomware risks, and data privacy regulationsExpert knowledge of available monitoring and threat-detection toolsFamiliarity with IAM toolsets including Active Directory and OktaSkills:Strong negotiation skills for keeping organizational focus on needed investments, while keeping the bigger HOPCo business picture in mindExpert knowledge and insight into cybersecurity threat vectors and ransomware risksCurrent and thorough knowledge regarding data privacy and protection regulations (HIPAA, GDPR, etc.)Expertise in technical infrastructure, network architecture, and data movementExpertise in data storage, cloud technologies, database configuration, data protection techniquesExpertise in system monitoring and threat detection toolsets and techniquesExcellent listening, analytical, and communication skillsAnalytical thinking and problem-solving skills, with acute attention to detail, accuracy and accountability balanced with sound business judgment.Exceptional interpersonal skillsAbilities:Ability to successfully manage multiple projects simultaneouslyAbility to communicate complex information in a clear and concise manner to managers and executivesAbility to practice good judgment and discretionAbility to act with integrityAbility to engage and foster strong partnershipsEnvironmental Working Conditions:Normal office environmentTravel requiredPhysical/Mental Demands:Requires sitting and standing associated with a normal office environment.Manual dexterity using a calculator and computer keyboard.Organizational Requirements:HOPCo Mission, Vision and Values must be read and signed.This description is intended to provide only basic guidelines for meeting job requirements. Responsibilities, knowledge, skills, abilities and working conditions may change as needs evolve.Equal Opportunity Employer This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor.