Director of Cybersecurity

Fair Haven Community Health Care 

For over 54 years, FHCHC has been an innovative and vibrant community health center, catering to multiple generations with over 165,000 office visits across 21 locations. Guided by a Board of Directors, most of whom are patients themselves, we take pride in being a healthcare leader dedicated to delivering high-quality, affordable medical and dental care to everyone, regardless of their insurance status or ability to pay. Our extensive range of primary and specialty care services, along with evidence-based programs, empowers patients to make informed choices about their health. As we expand our reach to underserved areas, our commitment to prioritizing patient needs remains unwavering. FHCHC's mission is to enhance the health and social well-being of the communities we serve through equitable, high-quality, and culturally responsive patient-centered care.

Job purpose

The Director of Cybersecurity owns and advances Fair Haven Community Health Center’s (FHCHC) enterprise cybersecurity program. Initially an individual contributor, the Director performs hands-on security operations (incident response, vulnerability management, email security, data loss prevention, and third-party risk) while leading strategy, governance, and risk management to protect the confidentiality, integrity, and availability of FHCHC systems and data. The Director will build and lead a cybersecurity team as the function grows.

Duties and responsibilities

Reporting to the Vice President, Data & Technology, the Director is FHCHC’s senior cybersecurity leader, combining hands-on work with strategy, governance, and advising executive and Board stakeholders. Typical duties include but are not limited to:

Strategic Leadership & Compliance

• Develop and execute a multi-year cybersecurity strategy, roadmap, and measurable objectives aligned with FHCHC’s business needs and risk appetite.
• Report on security posture, risk, incidents, compliance, investments, and cyber insurance to executive leadership, governance committees, and the Board.

Vendor & AI Security Management:

• Manage co-managed security services, assessors, auditors, and vendors, holding them to clear expectations and deliverables.
• Set security requirements for AI and emerging technologies to protect PHI and organizational data, including from public AI models; support AI governance, defend against AI-enabled attacks, and secure AI models and data pipelines.

Security Monitoring & Incident Response

• Lead and perform threat monitoring using SIEM, IDS/IPS, EDR, email security, DLP, and related tools.
• Lead incident and breach response, including containment, eradication, recovery, evidence handling, executive reporting, and post-incident review.
• Provide or coordinate after-hours response for material incidents and maintain escalation and on-call procedures.

Vulnerability & Risk Management

• Perform and direct vulnerability scanning, prioritization, remediation validation, and penetration testing.
• Lead enterprise cyber risk assessments, maintain a prioritized risk register, and recommend practical mitigations with accountable remediation plans.
• Set security requirements and verify that system owners patch, update, and harden systems.

Security Engineering & Administration

• Define security architecture principles, control requirements, and standards with IT and clinical technology teams.
• Oversee the operation and improvement of firewalls, access controls, IDS/IPS, endpoint protection, DLP, logging, and other security technologies.
• Provide governance over identity and access management, privileged access, and authentication.
• Embed security requirements into project intake, procurement, cloud adoption, system design, change management, and software delivery.

Infrastructure & Systems Support

• Set security requirements for virtualized and cloud environments and validate secure configuration with systems engineering staff.
• Provide independent security review of network and infrastructure changes; system owners retain responsibility for implementation.
• Promote safe automation of monitoring, evidence collection, reporting, and response.

Governance, Policy, & Training

• Own the cybersecurity policy framework, standards, and procedures, ensuring periodic review and adoption.
• Lead security awareness training and coach IT staff and stakeholders on cybersecurity practices.

Collaboration & Continuous Improvement

• Partner with clinical, operational, and business teams to securely deliver major technology, data, cloud, and AI initiatives, balancing security with patient-care needs.
• Use risk assessments, threat intelligence, and incident trends to prioritize improvements and stay current on threats and regulations.

Qualifications

Education & Certifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field required; master’s degree preferred.
• CISSP, CISM, HCISPP, or similar advanced certification strongly preferred.

Experience

• Minimum of 5 years of progressive cybersecurity experience, including ownership of significant security programs, incidents, or enterprise initiatives.
• Healthcare or other highly regulated experience strongly preferred, including practical knowledge of HIPAA and PHI.
• Proven player/coach who has led security monitoring, incident response, and risk decisions and presented to executives and boards.

Skills

• Advanced proficiency with SIEM, EDR, vulnerability management, identity and email security, DLP, IDS/IPS, and Microsoft 365 and cloud security.
• Strong command of security governance, architecture, IAM, network security, data protection, incident response, and third-party risk.
• Current knowledge of emerging threats, including ransomware, phishing, and AI-enabled attacks.
• Sound judgment, executive presence, and crisis leadership, with the ability to explain technical risk in business terms to non-technical and Board audiences.

• Ability to work independently, lead through influence, manage competing priorities, and build trust across stakeholders.

Direct Reports

• None.

What we offer

• Major medical, dental and vision
• Voluntary benefits (AFLAC plan, STD, LTD & Life Insurance)
• Paid Holidays
• Generous Paid Time Off (PTO)
• Tuition reimbursement
• And much more…

$alary: $131,385.00 (commensurate with qualifications & experience)

American with Disabilities Requirements:

External and internal applicants, as well as position incumbents who become disabled, must be able to perform the essential job specific functions (listed within each job specific responsibility) either unaided or with the assistance of a reasonable accommodation to be determined by the organization on a case by case basis.

Fair Haven Community Health Care is an Equal Opportunity Employer. FHCHC does not discriminate on the basis of race, religion, color, sex, age, non-disqualifying physical or mental disability, national origin, veteran status or any other basis covered by appropriate law. All employment is decided on the basis of qualifications, merit, and business need.