Information Security Architect

Excellus BCBS•Rochester, NY

About The Position

The Information Security Architect assists in developing and executing the information security risk management strategy, risk assessment philosophy, and IT components of Lifetime Healthcare Companies’ Enterprise Risk Management program. The position participates in IT security investment analysis, design, scope, and approach. Its primary responsibility is to provide technical expertise to the Information Security Group and serve as a trusted security advisor to business and divisional initiatives, helping ensure that secure, risk-based, and cost-effective infrastructure and application designs are developed and maintained. The architect advises and consults with Information Security management and business and IT leadership on protecting corporate information and the direction of the Information Security Program. The role has Level I and Level II classifications. Level I responsibilities include contributing to security architecture principles and standards, driving adoption and compliance, defining and carrying security requirements through project lifecycles, executing risk management activities, assessing solutions and vendors, consulting on projects, and supporting security technologies. The architect also develops collaborative relationships, processes, standards, and templates for managing information security risks, while supporting the company’s mission, privacy policies, and values. Level II adds leadership in developing and implementing architecture principles and standards, supporting risk strategy development, fostering a risk management culture, and mentoring department staff. The position requires five years of experience in an IT security role for Level I and seven years for Level II. A bachelor’s degree in computer science, information technology, or a relevant field is required, with six additional years of experience accepted in lieu of a degree. The role requires strong communication, collaboration, judgment, relationship management, and the ability to translate threats into practical security requirements. Travel within the Health Plan service region may be needed for meetings or training. Work may also be performed from a home office for business continuity. Compensation ranges are $87,766–$157,978 for Level I and $110,093–$198,168 for Level II. Remote work may be considered on a case-by-case basis.

Requirements

At least five years of experience in an Information Technology Security role for Level I; at least seven years of related experience in an Information Technology Security role for Level II.
Bachelor’s degree in computer science, information technology, or a relevant field; six additional years of experience may be substituted for the degree.
Exceptional communication and influencing skills, with the ability to balance differing stakeholder interests through analysis and persuasion.
Ability to work collaboratively with stakeholders inside and outside the organization.
Strong knowledge of TCP/IP protocols and broad, deep conceptual understanding of applications, application platforms, operating systems, and networks.
Experience with shell scripting, Perl, another scripting language, or a programming language such as Java, C++, or C.
Demonstrated ability to work with a diverse team and help develop and shape the organization’s security architecture.
Sound judgment, proven relationship management skills, and ability to support security architecture aspects of business and IT initiatives.
Understanding of process and its benefits in a maturing IT environment.
Ability to quickly learn newer security technologies, understand implementation requirements, and integrate technologies into a broader corporate solution.
Ability to translate real-world threats into actionable security tasks while balancing functionality and performance needs with prudent security measures, and understand the ramifications of system security decisions.
Ability to work prolonged periods sitting and/or standing at a workstation and working on a computer.
Ability to sit and/or stand at a workstation while viewing a computer and using a keyboard, mouse, and/or phone for three or more hours at a time.
Ability to travel across the Health Plan service region for meetings and/or trainings as needed.
Ability to work in a home office for continuous periods of time for business continuity.
For Level II, prior experience with architecture processes, strategies, and standards is required.

Nice To Haves

Experience with identity and access management architecture and implementation, user provisioning and de-provisioning, and single sign-on.
Experience with enterprise directories such as AD and LDAP.
Experience with multi-factor authentication.
Experience with network- and application-level security and encryption.
Experience with security event management.
Experience with firewall architecture and design.
Experience with cloud security controls.
Experience with web server security and application security.
Experience with PKI system implementation.
Experience with data loss prevention systems and implementation.
Experience with network and host intrusion detection and prevention systems.
Experience with remote access security controls and mobile security.
Familiarity with Sarbanes Oxley, HIPAA, HCFA, PCI/DSS, ISO27001, NIST security standards, COBIT, and COSO.
For Level II, at least one security industry certification, such as CISSP, CISA, CISM, or SANS.

Responsibilities

Participate in developing and implementing security architecture principles and standards aligned with the organization’s business and strategy; Level II leads this work.
Drive adoption of and compliance with security standards across development and infrastructure teams, including contracted teams.
Create functional and technical security requirements and follow them through the project lifecycle.
Execute an overall risk management strategy with business and divisional stakeholders, integrating risk management into operational, regulatory/statutory, financial, technical, and security processes.
Support the creation of robust disaster recovery and/or business continuity plans.
Perform risk-based assessments of solutions and vendors to ensure appropriate security controls are followed.
Provide security consultation, including design reviews and recommendations, for projects and initiatives.
Provide hands-on support for technologies operated by the Security and Risk Department.
Establish collaborative working relationships across divisions, the organization, and subsidiaries to manage information security risks and align solutions with business strategy.
Develop processes, standards, and templates for managing information security risks.
Support implementation of standards and solutions in collaboration with divisional teams to protect application and infrastructure assets.
Maintain member privacy in accordance with corporate privacy policies and procedures.
Demonstrate integrity and support the company’s mission, values, and Corporate Code of Conduct.
Maintain regular and reliable attendance and perform other functions assigned by management.
At Level II, help develop risk management strategy with business and IT stakeholders and foster a risk management culture through education, skill development, and effective processes and practices.
At Level II, mentor department staff and provide subject matter expertise to the division.