Key Responsibilities
Strategic Leadership
- Develop and execute a multi-year cybersecurity strategy aligned to organizational goals and healthcare regulatory requirements.
- Serve as a trusted advisor to executive leadership on cybersecurity risks, and incident response readiness.
- Lead enterprise risk assessments and define risk mitigation strategies for all data environments.
- Drive a culture of security awareness through training programs for clinicians, staff, and executives.
- Manage vendor relationships for security products, managed services, and consulting partners.
- As an advisor to Business and IT leadership, provide insights into security capabilities, vulnerabilities, current and emerging threats, and risk levels.
- Coordinate with compliance, legal, and audit teams on security audits, investigations, and reporting.
- Offer development guidance and assist in the identification, implementation, and maintenance of organizational information security policies and procedures in coordination with management and compliance leaders.
Cybersecurity Program Management
- Apply hands-on experience in deploying and managing security and network solutions, including Security Information and Event Monitoring (SIEM), Email Security, Endpoint Protection, Data Loss Prevention (DLP), and Intrusion Prevention/Detection Systems (IPS/IDS).
- Partner with department leaders, to ensure that IT security policies, processes, and technologies align with compliance, legislative requirements, and human resources best practices.
- Support audit activities conducted by internal, retained, or external audit sponsors.
- Assess the effectiveness and relevance of all IT security policies and procedures, enforcing compliance across customer Software as a Service (SaaS) environment, vendors, contractors, and all corporate end-users. Develop and maintain new, relevant information security policies as needed to remediate vulnerabilities within information systems.
- Manage and optimize the Security Awareness Program to ensure effective corporate awareness and compliance.
- Continuously evaluate the security capabilities of Technology systems and applications to identify gaps in defenses and pursue solutions to address those gaps.
- Developed a risk management and compliance framework for information security that aligns with the overall compliance strategy for AADermatology.
- Regularly review data and privacy projects within AADermatology to ensure that they support and align with corporate privacy and data security goals and policies.
- Ensure that the development of new products and services complies with AADermatology's information security policies and legal obligations.
- Established a process for receiving, documenting, tracking, investigating, and acting on information security incidents that affect the organization's information security policies and procedures.
- Aid in the planning, design, and evaluation of information security-related projects and have established an internal monitoring program for information security.
- As necessary, or according to established procedures, review the information security program and revise it based on changes in laws, regulations, or company policy.
- Monitor system development and operations to ensure compliance with information security standards.
- Conduct periodic information security assessments and ongoing compliance monitoring activities in conjunction with other organizational compliance and operational assessments.
- Oversee service providers by proposing reasonable steps for their selection and retention, ensuring they can maintain appropriate safeguards for AADermatology's information assets.
- Develop, maintain, and update the incident response capability for information security, ensuring it includes the detection, reporting, response, and mitigation of security incidents.
- Create and implement action plan procedures related to information security and ensure the preparation and maintenance of continuity plans for information systems that facilitate the operations and assets of AADermatology. Healthcare Compliance & Regulatory Oversight
- Ensure compliance with HIPAA, HITECH, CMS, PCI DSS, and applicable state regulations.
- Lead security risk assessments for EHRs, telehealth platforms, and other clinical technologies.
Technology & Operations
- Direct security architecture reviews for new systems, including EHR integrations, cloud migrations, and connected medical devices (IoMT).
- Oversee endpoint security, network security, and encryption strategies at all levels
- Lead disaster recovery (DR) and business continuity (BC) planning from a security perspective.
- Oversee the continuous monitoring and analysis of security alerts and logs, developing processes to respond appropriately to alerts.
Incident Response & Threat Management
- Act as the executive incident commander for security incidents, breaches, and ransomware attacks.
- Maintain and continuously test incident response plans.
- Collaborate with legal teams, Cyber Insurance providers, relevant agencies, and industry peers on threat intelligence information sharing and prevention methods.
