Director, Security & Privacy (HIPAA Privacy & Security, HITECH Act requirements)

Fujifilm•Remote,

2d•$134,406 - $186,696•Onsite

About The Position

The Director, Security and Privacy leads HCUS’s enterprise security & privacy programs. This role advises executive leadership on the security posture of the organization, including HCUS products, Cloud Services, HCUS business systems, and customer-facing technologies that process or store PHI. The Director requires a strong understanding of organizational, product, cloud, and customer security, as well as the ability to communicate effectively with technical teams, business leaders, regulators, auditors, legal counsel, and customers’ C-suite executives. The Director works closely with HLUS Security and coordinates the activities of groups spanning all HCUS business units, and the Product Security Incident Response Team across HCUS, HLUS, and FTYO. The Director provides guidance on information on security agreements, customer security requirements, regulatory obligations, and risk-management decisions. This role also plans and coordinates company resources to support compliance with HIPAA, SOC 2, applicable state and federal cybersecurity and privacy laws, and other relevant regulatory and contractual frameworks. As the official HCUS HIPAA Privacy Officer and HIPAA Security Officer, the Director oversees the development, implementation, and continuous improvement of policies, procedures, safeguards, incident-response processes, and compliance activities designed to protect PHI and other sensitive information. The role places equal emphasis on executing assigned responsibilities and coordinating with departments across the company, including HLUS and FTYO, to promote a consistent, integrated, risk-based approach to security and privacy. Through cross-functional collaboration, the Director supports the achievement of the organization’s short- and long-term security, privacy, and business objectives.

Requirements

Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Healthcare Administration, Privacy, Risk Management, or a related field; equivalent experience may be considered.
7+ years of progressive experience in information security, privacy, compliance, risk management, healthcare technology, or related discipline.
3+ years of experience leading or managing security, privacy, compliance, or governance programs.
Demonstrated experience with HIPAA Privacy Rule, HIPAA Security Rule, HITECH Act requirements, and healthcare breach response.
Experience leading SOC 2 readiness, audits, control implementation, and evidence management.
Experience conducting risk assessments, developing risk treatment plans, and managing remediation activities.
Experience developing and maintaining incident response, business continuity, and disaster recovery processes.
Strong knowledge of common security frameworks and standards, such as NIST Cybersecurity Framework, NIST SP 800-53, NIST SP 800-66, CIS Controls, ISO 27001, and SOC 2 Trust Services Criteria.
Familiarity with cloud security, SaaS application security, identity and access management, encryption, logging/monitoring, secure software development practices, and vendor risk management.
Ability to communicate complex security, privacy, and regulatory concepts effectively to technical teams, customers, executives, and non-technical workforce members.
Strong judgment, organizational skills, attention to detail, and ability to manage sensitive and confidential matters.

Nice To Haves

Experience in a healthcare SaaS, medical imaging, health IT, clinical informatics, PACS, RIS, DICOM, interoperability, or medical device-adjacent environment
Certifications such as CISSP, CISM, CISA, CRISC, HCISPP, CHPC, CHC, CHSP, CIPM, CIPP/US, or equivalent.
Experience with HITRUST, ISO 27001, PCI DSS, FDA cybersecurity considerations, or state healthcare privacy regulations.
Experience managing customer security assessments and enterprise healthcare customer requirements.
Experience with cloud environments such as AWS, Microsoft Azure, or Google Cloud Platform.
Familiarity with security operations, SIEM/logging platforms, endpoint protection, vulnerability scanning, and cloud security posture management tools.

Responsibilities

Serve as the organization’s designated HIPAA Security Officer and HIPAA Privacy Officer.
Develop, implement, maintain, and enforce the company’s information security, privacy, and program.
Establish and maintain a governance framework that supports compliance with HIPAA, HITECH, SOC 2, applicable state privacy laws, breach-notification requirements, contractual obligations, and other relevant healthcare and security standards.
Advise executive leadership on security, privacy, technology, and operational risks.
Present meaningful security, privacy, audit, and risk metrics to executive leadership and other stakeholders.
Maintain awareness of changes in healthcare privacy, cybersecurity, and regulatory requirements, translating those changes into actionable organizational improvements.
Own the development, review, approval, implementation, and periodic revision of HCUS security and privacy policies, standards, procedures, and supporting documentation.
Ensure policies address administrative, physical, and technical safeguards appropriate to HCUS’s systems, workforce, operations, and risk profile.
Maintain required HIPAA documentation, including risk analyses, risk management plans, policies, training records, incident documentation, access reviews, vendor assessments, and compliance evidence.
Lead periodic program assessments and continuous improvement initiatives to measure and improve security and privacy maturity.
Lead HCUS-wide security and privacy risk assessments, including HIPAA Security Rule risk analysis and periodic reassessments.
Identify, document, prioritize, and track remediation of security, privacy, operational, technical, and third-party risks.
Partner with Engineering, Product Management, HLUS Shared IT Services, Legal, and TAC teams to ensure security and privacy are incorporated into system design, software development, deployment, and operational processes.
Oversee vulnerability management, penetration testing, security testing, configuration reviews, access control reviews, and remediation tracking.
Ensure security controls are proportionate to HCUS’s risk profile and the sensitivity of PHI and other confidential information.
Lead the HCUS’s SOC 2 program, including scoping, control design, evidence collection, readiness activities, auditor coordination, remediation management, and annual attestation efforts.
Coordinate internal and external audits, customer assessments, security questionnaires, and regulatory inquiries.
Maintain audit-ready evidence demonstrating operation of security and privacy controls.
Monitor compliance with contractual commitments, Business Associate Agreements (BAAs), customer security requirements, and data protection obligations.
Partner with internal teams and external advisors to address audit findings, corrective action plans, and compliance gaps.
Continuously develop, maintain, test, and improve the HCUS’s security incident response and breach-response plans.
Lead or coordinate response activities for suspected or confirmed security incidents, privacy incidents, and PHI breaches.
Ensure incidents are appropriately investigated, documented, contained, remediated, and reviewed.
Coordinate with leadership, legal counsel, technical teams, customers, insurers, and other stakeholders as appropriate during significant incidents.
Support breach-risk assessment and notification decision-making in accordance with HIPAA, state law, contractual requirements, and company policy.
Conduct post-incident reviews and ensure corrective actions are assigned, tracked, and completed.
Partner with technical leadership to oversee the security architecture and safeguards protecting cloud environments, applications, endpoints, networks, identities, integrations, and data.
Support implementation and operation of controls such as identity and access management, multi-factor authentication, encryption, logging and monitoring, secure configuration management, vulnerability management, backup and recovery, and business continuity capabilities.
Promote secure software development lifecycle practices, including security requirements, code review, dependency management, security testing, threat modeling, and release controls.
Ensure appropriate protections for medical imaging data, DICOM workflows, integrations, APIs, interoperability platforms, and connected customer environments.
Establish and oversee a third-party risk management program for vendors, subcontractors, cloud service providers, and other business partners that may access, process, transmit, or store PHI or other sensitive data.
Review security and privacy due diligence materials, including SOC reports, penetration testing summaries, certifications, data protection terms, and business continuity documentation.
Ensure appropriate contractual safeguards, including BAAs and security requirements, are in place before third-party access to PHI or sensitive systems is granted.
Support customer due diligence requests, security reviews, and discussions with customer information security, privacy, procurement, and compliance teams.
Develop and administer security and privacy awareness training for all HCUS members.
Ensure role-based training is provided to employees and contractors with specialized responsibilities or access to PHI, production systems, or sensitive information.
Foster a culture of security, privacy, accountability, and timely incident reporting across HCUS.