Manager, Information Security

To achieve and maintain our high-quality standards, we see to partner with physicians and staff who share our vision, values and brand promises and are dedicated to advancing our culture. QualDerm providers and staff are well-trained, highly skilled and recognized as leaders in the specialty of dermatology.

We currently have 158 practices in 17 states, spanning across the full spectrum of dermatology, skin cancer care, cosmetics, plastic surgery, and pathology with continued plans to expand further across the nation.

We will partner with you to establish the best combination of environment, technology, teamwork and personal reward opportunities to earn your confidence that we are your best place to work.

Purpose:

Our organization operates a network of healthcare facilities and is investing in building out a mature, right-sized information security program to protect patient data, clinical operations, and business systems across all sites. We are seeking a Manager, Information Security to own the company's overall security posture end-to-end.

This is a hands-on, builder-oriented role, not a purely governance or policy-writing position. The ideal candidate has personally implemented security programs and controls, as a security architect, security engineer, or similar, and is comfortable being both the strategist setting direction and the practitioner in the tools day to day. You will partner closely with the Director, IT Infrastructure & Cloud, Director - Applications, and Data Analytics teams to ensure security is embedded into infrastructure, cloud (Azure), network, and endpoint architecture, while independently owning the company's overall security strategy, governance, and risk posture.

Essential Duties and Responsibilities:

Security Strategy & Program Ownership

• Own and evolve the company's overall information security strategy, roadmap, and maturity model, appropriately scoped for the size of the company.
• Act as the organization's senior-most day-to-day security leader, briefing leadership on risk posture, incidents, and program progress.
• Define, track, and report on security KPIs/metrics (risk reduction, vulnerability remediation SLAs, incident response times, control coverage).
• Build and manage the information security tooling, staffing, and third-party assessments.

Hands-On Security Architecture & Engineering

• Personally design and implement security architecture across identity, network, endpoint, cloud (Azure), and application layers; this is a working leader role, not purely oversight.
• Own the technical implementation and tuning of core security tooling: SIEM/SOAR, EDR/XDR, vulnerability management, email security, DLP, CASB, and identity/access management (Azure AD/Entra ID, PAM, MFA/conditional access).
• Design and enforce network and cloud security architecture in partnership with the Director, IT Infrastructure & Cloud (segmentation, firewall/NGFW policy, cloud security posture management).
• Lead vulnerability management and penetration testing programs, driving remediation across infrastructure, application, and data teams.
• Own the organization's compliance posture for HIPAA, and applicable state/federal security regulations.
• Conduct and maintain enterprise risk assessments, third-party/vendor security risk reviews, and business associate agreement (BAA) security requirements.
• Develop, maintain, and test incident response, disaster recovery, and business continuity plans; lead tabletop exercises.
• Serve as key point of contact for security audits, regulatory inquiries, and cyber insurance underwriting/renewals.
• Lead detection, response, and remediation for security incidents, coordinating with IT Infrastructure, clinical operations, legal, and external forensics/counsel as needed.
• Own threat intelligence monitoring and proactive threat hunting to identify risk before it becomes an incident.
• Maintain and continuously improve the security monitoring and alerting environment (SIEM use cases, detection engineering).

Security Awareness & Culture

• Design and lead the company-wide security awareness and phishing simulation program partnering with training team, across all sites.
• Partner with HR, Compliance, and clinical leadership to embed security practices into onboarding, training, and day-to-day workflows.
• Build positive, collaborative relationships with IT, clinical, and business stakeholders to drive security adoption without becoming a bottleneck to operations.

Cross-Functional Partnership

• Partner closely with the Director, IT Infrastructure & Cloud on all infrastructure, network, and cloud initiatives (Azure migrations, de-novo site launches, M&A integrations) to ensure security is designed in from the start, not bolted on afterward.
• Participate in technical due diligence and security risk assessment for M&A activity and de-novo site launches, in coordination with the infrastructure team.
• Advise application, data, and clinical systems teams on secure design practices (secure SDLC, API security, EHR/clinical system integrations).
• Perform other duties as assigned
• Adheres to Code of Conduct and Mission & Value Statement.
• Participates in special projects as needed.

Company Summary:

To achieve and maintain our high-quality standards, we see to partner with physicians and staff who share our vision, values and brand promises and are dedicated to advancing our culture. QualDerm providers and staff are well-trained, highly skilled and recognized as leaders in the specialty of dermatology.

We currently have 158 practices in 17 states, spanning across the full spectrum of dermatology, skin cancer care, cosmetics, plastic surgery, and pathology with continued plans to expand further across the nation.

We will partner with you to establish the best combination of environment, technology, teamwork and personal reward opportunities to earn your confidence that we are your best place to work.

Purpose:

Our organization operates a network of healthcare facilities and is investing in building out a mature, right-sized information security program to protect patient data, clinical operations, and business systems across all sites. We are seeking a Manager, Information Security to own the company's overall security posture end-to-end.

This is a hands-on, builder-oriented role, not a purely governance or policy-writing position. The ideal candidate has personally implemented security programs and controls, as a security architect, security engineer, or similar, and is comfortable being both the strategist setting direction and the practitioner in the tools day to day. You will partner closely with the Director, IT Infrastructure & Cloud, Director - Applications, and Data Analytics teams to ensure security is embedded into infrastructure, cloud (Azure), network, and endpoint architecture, while independently owning the company's overall security strategy, governance, and risk posture.

Essential Duties and Responsibilities:

Security Strategy & Program Ownership

• Own and evolve the company's overall information security strategy, roadmap, and maturity model, appropriately scoped for the size of the company.
• Act as the organization's senior-most day-to-day security leader, briefing leadership on risk posture, incidents, and program progress.
• Define, track, and report on security KPIs/metrics (risk reduction, vulnerability remediation SLAs, incident response times, control coverage).
• Build and manage the information security tooling, staffing, and third-party assessments.

Hands-On Security Architecture & Engineering

• Personally design and implement security architecture across identity, network, endpoint, cloud (Azure), and application layers; this is a working leader role, not purely oversight.
• Own the technical implementation and tuning of core security tooling: SIEM/SOAR, EDR/XDR, vulnerability management, email security, DLP, CASB, and identity/access management (Azure AD/Entra ID, PAM, MFA/conditional access).
• Design and enforce network and cloud security architecture in partnership with the Director, IT Infrastructure & Cloud (segmentation, firewall/NGFW policy, cloud security posture management).
• Lead vulnerability management and penetration testing programs, driving remediation across infrastructure, application, and data teams.
• Own the organization's compliance posture for HIPAA, and applicable state/federal security regulations.
• Conduct and maintain enterprise risk assessments, third-party/vendor security risk reviews, and business associate agreement (BAA) security requirements.
• Develop, maintain, and test incident response, disaster recovery, and business continuity plans; lead tabletop exercises.
• Serve as key point of contact for security audits, regulatory inquiries, and cyber insurance underwriting/renewals.
• Lead detection, response, and remediation for security incidents, coordinating with IT Infrastructure, clinical operations, legal, and external forensics/counsel as needed.
• Own threat intelligence monitoring and proactive threat hunting to identify risk before it becomes an incident.
• Maintain and continuously improve the security monitoring and alerting environment (SIEM use cases, detection engineering).

Governance, Risk & Compliance

• Own the organization's compliance posture for HIPAA, and applicable state/federal security regulations.
• Conduct and maintain enterprise risk assessments, third-party/vendor security risk reviews, and business associate agreement (BAA) security requirements.
• Develop, maintain, and test incident response, disaster recovery, and business continuity plans; lead tabletop exercises.
• Serve as key point of contact for security audits, regulatory inquiries, and cyber insurance underwriting/renewals.
• Incident Response & Threat Management
• Lead detection, response, and remediation for security incidents, coordinating with IT Infrastructure, clinical operations, legal, and external forensics/counsel as needed.
• Own threat intelligence monitoring and proactive threat hunting to identify risk before it becomes an incident.
• Maintain and continuously improve the security monitoring and alerting environment (SIEM use cases, detection engineering).

Security Awareness & Culture

• Design and lead the company-wide security awareness and phishing simulation program partnering with training team, across all sites.
• Partner with HR, Compliance, and clinical leadership to embed security practices into onboarding, training, and day-to-day workflows.
• Build positive, collaborative relationships with IT, clinical, and business stakeholders to drive security adoption without becoming a bottleneck to operations.

Cross-Functional Partnership

• Partner closely with the Director, IT Infrastructure & Cloud on all infrastructure, network, and cloud initiatives (Azure migrations, de-novo site launches, M&A integrations) to ensure security is designed in from the start, not bolted on afterward.
• Participate in technical due diligence and security risk assessment for M&A activity and de-novo site launches, in coordination with the infrastructure team.
• Advise application, data, and clinical systems teams on secure design practices (secure SDLC, API security, EHR/clinical system integrations).
• Perform other duties as assigned
• Adheres to Code of Conduct and Mission & Value Statement.
• Participates in special projects as needed.

Requirements

• Bachelor's degree in Information Security, Computer Science, or related field (or equivalent experience).
• 8+ years of progressive information security experience, including prior hands-on roles such as Security Architect, Security Engineer, or Senior Security Analyst, with demonstrated ownership of security program implementation (not just policy or audit work).
• 2+ years in a security leadership role, owning strategy and program direction for an organization or business unit.
• Deep, hands-on experience with core security domains: identity and access management, network security, endpoint/EDR, cloud security (Azure preferred), vulnerability management, and SIEM/detection engineering.
• Demonstrated experience building or maturing a security program largely from the ground up or through a significant maturity uplift.
• Working knowledge of healthcare regulatory and compliance frameworks (HIPAA, HITECH); HITRUST or SOC 2 program experience a plus.
• Experience leading incident response for real-world security incidents, including coordination with legal, executive leadership, and external parties.
• Strong communication skills, with the ability to translate technical risk into business terms for non-technical executives and board members.

Preferred:

• Relevant certifications such as CISSP, CISM, CCSP, or Microsoft Certified: Azure Security Engineer Associate.
• Experience in multisite healthcare delivery organizations (hospital systems, ambulatory networks, home health, behavioral health, or similar).
• Experience supporting security due diligence and integration for mergers, acquisitions, or de-novo site launches.
• Familiarity with EHR/clinical systems and their unique security and compliance requirements.
• Prior experience operating as the most senior security leader in an organization.

Benefits

Benefits of joining Qualderm Partners:

• Competitive Pay - Attractive compensation to reward your hard work
• Comprehensive Health Coverage - Includes Medical, Dental, and Vision plans to keep you covered
• Generous 401(k) Plan - Company matches 100% of the first 3%, plus 50% of the next 2%, with immediate vesting
• Paid Time Off (PTO) - Accrue PTO from day one, plus enjoy 6 paid holidays and 2 floating holidays each year
• Company-Paid Life Insurance - Peace of mind with basic life coverage, with the option for additional plans
• Disability Protection - Short-term and long-term disability coverage to protect you in unexpected circumstances
• Additional Wellness Plans - Accident, critical illness, and identity theft protection plans for extra security
• Employee Assistance Program (EAP) - Access confidential support for personal or work-related challenges
• Exclusive Employee Discounts - Save on products and services with special discounts just for you
• Referral Bonus Program - Earn bonuses by referring qualified candidates to join the team

QualDerm Partners is proud to be an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Applicants must be currently authorized to work in the United States in a full-time basis.