Director of Cybersecurity

City: Jackson

State: Tennessee

Shift: 0 - Day (United States of America) (inactive)

Job Description Summary: The Cybersecurity Director is responsible for developing the organization's security strategy and overseeing the operational execution of the organization's cybersecurity program. This role ensures the protection for sensitive patient and personal data, critical healthcare systems, and operational continuity across all facilities. The Director collaborates with the CIO to implement strategic security initiatives, manages a team of cybersecurity professionals, and ensures regulatory compliance.

ESSENTIAL JOB FUNCTIONS: Strategic Security Leadership

Budget Management: Develop and manage the budget for the department, justifying expenditures for tools and staff. Forecast spending projects for up to three years.

Risk Assessment & Management: Oversee regular security risk assessments, vulnerability scans, and penetration testing, ensuring that mitigation measures are promptly addressed. Maintain and evolve the organization's risk management framework, prioritizing resources and projects based on risk impact. Work with Directors across the organization to help assess cybersecurity risk in all areas.

Regulatory Compliance: Responsible for compliance with healthcare-specific regulations such as HIPAA, HITECH, and state privacy laws. Develop, maintain, and enforce policies, standards, guidelines, and procedures to meet regulatory requirements. Working with the entire organization, select additional frameworks as needed or desired to provide value to the organization.

Team Leadership & Development: Manage and mentor a team of cybersecurity analysts and engineers, providing guidance on professional development and continuous improvement. Foster a culture of collaboration and knowledge sharing within the security team and across IT departments. Allocate resources and delegate responsibilities effectively.

Security Culture: Promote a security-focused culture across the organization, ensuring staff are equipped to identify and report suspicious activity. Develop security champions across the organization to support and promote security initiatives in their departments. Develop the Cybersecurity and Risk Management Steering Committee (CRM Steering Committee) with representatives from various departments including, but not limited to, Executive Leadership, IT, Legal, HR, Finance, Compliance, Clinical, Operations, Sales/Marketing, and Facilities. Partner with HR to enforce security policies and accountability. Educate leadership on their role in supporting cybersecurity.

Collaboration & Stakeholder Engagement: Work closely with clinical and administrative stakeholders to understand operational needs while maintaining a secure infrastructure. Communicate cybersecurity risks, mitigation strategies, and operational impacts clearly and effectively to non-technical stakeholders using metrics that are tailored to the need of the key stakeholder. Organize & lead organizational IT security audits and assessments required by HIPAA, PCI, and other selected frameworks. Monitors industry security updates, technologies and best practices to improve security management. Demonstrates expertise in project management to include the use of tools; plan and schedule tasks based on project timeline, establish tasks and appropriate dependence to set timeline and achieve desired target dates. Serves as a resource for the Cybersecurity team. Serves in an advisory role to all organizational departments in matters of security outside of cybersecurity in relation to HIPAA and other regulatory requirements, including but not limited to physical security, information security including paper records, etc. Leads incident response and crisis management. Ability to give formal presentations at all levels. Support department/strategic goals set by management. Performs employee evaluations. Evaluates employee skill levels to determine expertise. Monitors vendor service levels, coordinates service issues with equipment vendors and documents vendor maintenance performance. Requires close coordination and communication with vendors. Facilitate inter / intra departmental relationships. Works with Executive Leadership, the Quality Council, and the Board of Directors to support and achieve the organization's Mission, Vision, Values, and Organizational Goals. JOB SPECIFICATIONS:EDUCATION:Bachelors Degree Master's degree in Computer Science, Information Technology, Cybersecurity, or a related field required. Master degree preferred. LICENSURE, REGISTRATION, CERTIFICATION:Requires industry standard certifications (current): CISSP or CISM.Preferred but not required related certifications include: PMP, ITIL, or other industry-related certifications.

EXPERIENCE: Minimum of 10 years work experience with knowledge of networks, system administration, and information security. Minimum of five years of experience in a security leadership position. Proven ability to create and manage a cybersecurity budget or refine an existing one, projecting costs for up to three years. Demonstrated skill in evaluating trade-offs between security investments and risks, justifying expenditures to non-technical executives. History of negotiating contracts with cybersecurity vendors to optimize costs while meeting security needs. Proven ability to manage multiple projects. Experienced in coordinating efforts across a large and diverse organization. Experienced in using Project Management tools and the ability to present the information in a precise and understandable manner to the end users, team members, management, and vendors alike. Executive experience and experience working directly with a Board of Directors preferred.

KNOWLEDGE, SKILLS AND ABILITIES: The ability to read, see, and hear to collect, comprehend, interpret, and retain information that can be applied to work procedures. Performs highly complex and varied tasks requiring independent knowledge, its application to a variety of situations, as well as exercise of independent judgment. Must have the ability to interpret, adapt and apply guidelines, criteria and procedures. Must be able to perform complex mathematical and technological processes. Must be able to write, spell, understand and apply rules of grammar and punctuation, and to edit and supervise his/her own work. Must be able to communicate verbally and in written form. Ability to manage multiple projects with minimal supervision. Strong interpersonal skills to interact with clients, team members, and upper management. Self-discipline to work according to playbook and time requirements. NONDISCRIMINATION NOTICE STATEMENTWe are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, ethnicity, disability, religion, national origin, gender, gender identity, gender expression, marital status, sexual orientation, age, protected veteran status, or any other characteristic protected by law.