Vice President, Chief Information Security Officer

Position Overview

The Vice President of Information Security/CISO reports directly to the SVP, Chief Risk Officer and will oversee the enterprise-wide security program. The security program includes Governance, Risk and Compliance ("GRC"), Disaster Recovery Management, Identity and Access Management and Cyber Operations. The CISO must have a strong technical background and fully understand threats, risk mitigation and technical controls. The CISO assumes accountability for the daily security tactical operations and overall strategic execution of corporate security roadmaps that safeguard company data and systems against evolving cybersecurity threats. Other responsibilities include collaborating across the health system to develop an incident command structure and plan, balancing security risk management with cost-effective decision-making to support business and care delivery priorities, and fostering a culture of security awareness and continuous improvement throughout the organization. The CISO exhibits a blend of leadership qualities as a thought leader and strategic thinker, mentoring teams, communicating effectively with stakeholders, and scaling the security program in anticipation of changing risks. A decisive leader under pressure and a continuous learner, the ideal candidate will stay updated on the latest security trends, threats, and technologies. Note: Hybrid - must be available to attend onsite once-a-month meetings, as well as provide executive presence as needed.

Key Responsibilities

• Develops, implements and monitors a strategic, comprehensive enterprise information security risk management program using a risk-based approach.
• Drives the development and execution of a comprehensive information security strategy and incident response roadmap and plan that aligns with business goals and industry best practices.
• Leads and partners with operations across the system to develop, modify and maintain organizational incident response plans, including a comprehensive ransomware event plan.
• Provides regular reporting on the current status of the information security program to executive leadership and board members.
• Collaborates with senior management and key business stakeholders (audit & risk, legal, compliance, operations, IT) to align initiatives and resources to meet overall business objectives.
• Engages with corporate and external auditors, compliance and legal teams to ensure compliance with internal plans, laws and regulations, including privacy requirements.
• Establishes and enforces robust information security policies, standards, and procedures, ensuring adherence across the organization.
• Effectively leads incident response efforts in the event of a cybersecurity breach or incident, coordinating with internal teams and external stakeholders to mitigate impact and ensure timely resolution and communication.
• Oversees a program that evaluates the security posture of third-party vendors and partners, ensuring that appropriate security measures are in place to protect shared data and resources.
• Defines security requirements and manages security risks associated with third-party vendors to ensure compliance with organizational standards.
• Demonstrates working knowledge of HIPAA, the NIST Cybersecurity Framework, PCI, ITIL, and Information Security Best Practices.
• Possesses working knowledge of security technologies such as SIEM, endpoint detection and response, network protection (IPS, NAC, firewalls), vulnerability management, and identity management.
• Exhibits a strong understanding of cloud security and experience with cloud service providers (AWS, Azure, etc.) and Artificial Intelligence as it relates to healthcare entities.
• Provides strong leadership to team members through mentoring, career development, and interpersonal skills.
• Demonstrates effective team leadership and collaboration, resolving complex issues while balancing conflicting priorities.
• Fosters a culture of high performance, productivity, creativity, and innovation.
• Stays informed on the evolving landscape of security and technology to continuously improve practices, policies, and awareness.
• Performs other duties as assigned.

Required Qualifications

• Certifications: Certified Information Systems Security Professional (CISSP)
• Education: Bachelor's Degree in Computer Science or a related field
• Work Experience: 5+ years in Healthcare Leadership in Information Cyber Security

Benefits & Perks

• Compensation: The compensation range for this position is $0 per hour - $0 per hour. This represents a good faith minimum and maximum range at the time of posting. Actual compensation will depend on various factors.
• Benefits: Carle Health offers a comprehensive benefits package for team members. For more details, visit careers.carlehealth.org/benefits.