Information Security Architect

company•City of Utica, NY

1d•$87,766 - $198,168

About The Position

The Information Security Architect assists in developing and executing the information security risk management strategy, risk assessment philosophy, and IT components of Lifetime Healthcare Companies’ Enterprise Risk Management program. The position participates in IT security investment analysis, design, scope, and approach, and provides technical expertise to the Information Security Group while serving as a trusted security advisor to business and divisional initiatives. The architect helps ensure secure, risk-based, and cost-effective infrastructure and application designs are developed and maintained, and advises Information Security management and business and IT leadership on protecting corporate information and the direction of the Information Security Program. The position has two classification levels. Level II includes the Level I accountabilities and qualifications, with additional leadership, strategy development, risk-culture, mentoring, experience, and vendor-coordination expectations. The role requires prolonged workstation and computer use, may involve travel across the Health Plan service region for meetings or training, and requires the ability to work in a home office for continuous periods for business continuity. Remote work may be available on a case-by-case basis.

Requirements

At least five years of experience in an Information Technology Security role for Level I; at least seven years of related experience in an Information Technology Security role for Level II.
Bachelor’s degree in computer science, information technology, or a relevant field; six additional years of experience may substitute for the degree.
Exceptional communication and influencing skills, with the ability to balance stakeholder interests through sound analysis and persuasion.
Ability to work collaboratively with stakeholders inside and outside the organization.
Strong knowledge of TCP/IP protocols and broad, deep conceptual understanding of applications, application platforms, operating systems, and networks.
Experience with shell scripting, Perl, another scripting language, or a programming language such as Java, C++, or C.
Ability to work with diverse teams and help develop and shape the organization’s security architecture.
Sound judgment, relationship management skills, and ability to support security architecture aspects of business and IT initiatives.
Understanding of processes and their benefits in a maturing IT environment.
Ability to quickly learn newer security technologies, their implementation requirements, and their integration into larger corporate solutions.
Ability to translate real-world threats into actionable security tasks while balancing functionality and performance with prudent security measures, and to understand the ramifications of system security decisions.
For Level II, prior experience with architecture processes, strategies, and standards is required.
For Level II, experience coordinating vendor solution delivery and partnering effectively with vendors to meet business needs.

Nice To Haves

Experience with identity and access management architecture and implementation, user provisioning and de-provisioning, and single sign-on.
Experience with enterprise directories such as AD and LDAP.
Experience with multi-factor authentication.
Experience with network and application-level security and encryption.
Experience with security event management.
Experience with firewall architecture and design.
Experience with cloud security controls.
Experience with web server security and application security.
Experience with PKI system implementation.
Experience with data loss prevention systems and implementation.
Experience with intrusion detection and prevention systems for network and host systems.
Experience with remote access security controls and mobile security.
Familiarity with Sarbanes Oxley, HIPAA, HCFA, PCI/DSS, and other regulations affecting security, as well as ISO27001, NIST security standards, COBIT, and COSO.
For Level II, at least one security industry certification, such as CISSP, CISA, CISM, or SANS.

Responsibilities

Participate in developing and implementing security architecture principles and standards aligned with organizational business strategy; at Level II, lead this work.
Drive adoption and compliance with security standards across development and infrastructure teams, including contracted teams.
Create functional and technical security requirements and guide them through the project lifecycle.
Execute the risk management strategy with business and divisional stakeholders, integrating risk management into operational, regulatory/statutory, financial, technical, and security processes, including disaster recovery and business continuity planning.
Conduct risk-based assessments of solutions and vendors to verify appropriate security controls.
Provide security consultation, design reviews, and recommendations for projects and initiatives.
Provide hands-on support for technologies owned and operated by the Security and Risk Department.
Build collaborative relationships across divisions, the organization, and subsidiaries to manage Information Security risks and align solutions with business strategy.
Develop processes, standards, and templates for managing information security risks, and support implementation of standards and solutions with divisional teams.
Protect member privacy in accordance with corporate privacy policies and procedures.
Demonstrate integrity, support the company mission and values, adhere to the Corporate Code of Conduct, and lead according to Lifetime Way values and beliefs.
Maintain regular and reliable attendance and perform other functions assigned by management.
At Level II, help develop the overall risk management strategy with business and IT stakeholders.
At Level II, foster a risk management culture through education, skill development, and effective risk management processes and practices.
At Level II, mentor department staff and provide subject matter expertise to the division.