Principal Security Consultant (United States)

A Principal Security Consultant is responsible for providing industry expertise to First Health Advisory’s clients. Principal Consultants can perform a variety of tasks based on the individual needs of First Health Advisory’s clients. The Principal Security Consultant plays a critical role in advising clients on best practices for securing their IT infrastructure, identifying vulnerabilities, and implementing robust security measures. The Principal Security Consultant will lead security initiatives, design solutions to address complex security challenges, and guide the implementation of security technologies and strategies on behalf of and in partnership with First Health clients to help them build a resilient, secure environment successfully. As tenured consultants, a Principal Consultant helps mentor other consultants, leads client projects, and can present various project/program updates to client stakeholders.

Responsibilities

• Lead and support multiple First Health clients in support of program/project tasks
• Present assessment findings and/or program/project updates to client stakeholders
• Mentor First Health’s Consultants and Senior Consultants
• Track program/project tasks to ensure timely competition and delivery
• Provide industry-specific expertise and guidance to clients
• Brainstorm strategies for growth, positive change and improvement
• Lead presentations and organize team meetings
• Solve problems through helpful recommendations and practical suggestions
• Additional responsibilities and duties as assigned

Duties

• Lead and manage security consulting projects, delivering high-quality solutions to clients across various industries.
• Develop and deliver security awareness and resilience training programs to client teams to strengthen their security posture.
• Identify, assess, and prioritize security risks for clients, providing actionable recommendations to mitigate threats and vulnerabilities.
• Assess and develop enterprise security programs and reporting on organizational risk management strategies and tactics.
• Communicate and present strategic security program findings and recommendations to client senior management and executive leadership.
• Disseminate and present security, technology, and similar complex topics to management, leadership, and executives.
• Collaborate with senior leaders and departments to assess risks, coordinate mitigation efforts, establish internal controls, respond to incidents, and manage concerns.
• Develop security and organizational policies to comply with security requirements as defined by client.
• Develop and maintain strong relationships with clients, becoming a trusted advisor on all matters related to cybersecurity.
• Perform duties and responsibilities pursuant to the information security code of ethics.
• Mentor and coach junior consultants, providing leadership and technical guidance to grow the consulting team’s capabilities.
• Stay current with emerging security trends, technologies, and regulations to maintain expertise and inform clients of new risks or opportunities.

Education and Experience

• Bachelor’s or Master’s Degree – Computer Science, Information Technology, Cybersecurity or similar, or equivalent work experience.
• Industry-recognized certification in information security strongly preferred: CISSP, CRISC, CISM, HCISSP, or similar.
• Minimum of 10 years of experience in information security, risk management, compliance, and/or governance.
• Minimum of 5 years in a consulting or client-facing role.
• Minimum of 5 years of project management experience.
• Minimum 5 years security program leadership experience.
• Expertise in a wide range of security disciplines, including general information technology, data governance, network security, cloud security, penetration testing, security architecture, incident response, and threat intelligence.
• Organizational management experience including leadership, budget management, staff management, organizational chart assessment, and related leadership experience and knowledge.
• Significant experience with legal and regulatory compliance standards and security frameworks and controls such as NIST Cyber Security Framework (CSF), NIST 800-53, ISO 2700x, PCI-DSS, HIPAA, HITRUST, 405(d) HICP, etc.
• Ability to translate regulatory requirements into practical business considerations and recommendations
• Ability to proactively identify opportunities for continuous improvement
• Experience with process, risk and controls management including development of security program roadmaps, project plans and driving program maturity and conformance.