Data Security Architect

Texas Children's Medical Center•Houston, TX

About The Position

The Data Security Architect supports Texas Children's Third-Party Risk Management (TPRM) program by assessing cybersecurity risks associated with third-party vendors, applications, cloud-hosted and SaaS solutions, artificial intelligence, and emerging technologies. The role manages the risk assessment lifecycle from intake through closure, evaluates vendor security architecture, data flows, and documentation against Texas Children's policies, standards, and regulatory requirements, and validates controls and attestations. The Data Security Architect documents and communicates risks, control gaps, and recommended mitigations in ServiceNow GRC; partners with business owners, vendors, and technical teams; and supports exception management, risk acceptance, process improvement, and audit activities to help protect patient and organizational data.

Requirements

High school diploma or GED.
Five years of experience in information services (IS), computer management, or IS networking, including at least three years of information security experience.

Nice To Haves

Experience in information security, cybersecurity risk assessments, third-party risk management, or Governance, Risk & Compliance (GRC).
Knowledge of cybersecurity frameworks and regulatory requirements, including NIST, ISO 27001, HIPAA, HITRUST, and PCI DSS.
Ability to interpret SOC 2 reports, security certifications, technical architecture diagrams, and vendor security documentation.
Understanding of cloud security, identity and access management, encryption, vulnerability management, and data protection principles.
Familiarity with ServiceNow GRC or comparable risk management platforms.
Strong analytical, problem-solving, communication, documentation, and stakeholder management skills.
Experience in healthcare or another highly regulated industry.
Relevant professional certifications such as CRISC, CISM, CISSP, CISA, or Security+.

Responsibilities

Conduct cybersecurity risk assessments and reassessments of third-party vendors, applications, and technology solutions.
Manage the third-party risk assessment lifecycle, including intake reviews, documentation requests, risk evaluation, reporting, and assessment closure.
Review and evaluate vendor security documentation, including SOC 2 reports, ISO 27001 certifications, HITRUST assessments, security white papers, and architecture diagrams.
Evaluate vendor security architecture, data flows, system integrations, and third-party access to identify potential cybersecurity risks.
Assess security risks associated with cloud-hosted solutions, SaaS applications, artificial intelligence, and emerging technologies.
Evaluate security controls against Texas Children's information security policies, standards, and applicable regulatory requirements.
Identify, document, and communicate cybersecurity risks, control deficiencies, and recommended risk mitigation measures.
Perform risk validation activities, review control attestations, and coordinate with responsible stakeholders to address outstanding security requirements.
Maintain accurate risk assessment records, findings, control evidence, and supporting documentation within ServiceNow GRC.
Collaborate with business owners, vendors, project managers, and technical teams to gather security information, clarify requirements, and communicate assessment findings.
Monitor assessment progress, outstanding documentation, and risk validation activities to support timely completion within established service-level expectations.
Identify material changes to existing vendor solutions that may require additional risk assessments or reassessments.
Support security exception management, risk acceptance processes, and documentation of identified control gaps.
Assist in developing and improving TPRM policies, procedures, assessment methodologies, reporting metrics, and operational processes.
Support internal and external audit activities by providing third-party risk assessment records and supporting evidence.