Information Security Architect

Univera Healthcare•Rochester, NY

1d•$87,766 - $198,168

About The Position

The Information Security Architect assists with developing and executing the information security risk management strategy, risk assessment philosophy, and IT components of Lifetime Healthcare Companies’ Enterprise Risk Management program. The position participates in IT security investment analysis, design, scope, and approach, and provides technical expertise to the Information Security Group while serving as a trusted security advisor to business and divisional initiatives. The architect helps ensure that secure, risk-based, and cost-effective infrastructure and application designs are developed and maintained. The role advises and consults with Information Security management and business and IT leaders about protecting corporate information and the direction of the Information Security Program. The role has Level I and Level II classifications. Level II includes the Level I accountabilities and qualifications, with additional leadership, mentoring, risk-management, and experience expectations. The position requires regular and reliable attendance, supports member privacy and corporate values, and may involve travel across the Health Plan service region. Remote work may be possible on a case-by-case basis.

Requirements

At least five years of experience in an Information Technology Security role for Level I; at least seven years of related experience in an Information Technology Security role for Level II.
Bachelor’s degree in computer science, information technology, or a relevant field; in lieu of a degree, six additional years of experience are required.
Exceptional communication and influencing skills, including the ability to balance differing stakeholder interests through analysis and persuasion.
Ability to collaborate with stakeholders inside and outside the organization.
Strong knowledge of TCP/IP protocols and broad, deep conceptual understanding of applications, application platforms, operating systems, and networks.
Experience with shell scripting, Perl, another scripting language, or a programming language such as Java, C++, or C.
Ability to work with a diverse team and help develop and shape the organization’s security architecture.
Sound judgment, relationship-management skills, and ability to support security architecture for business and IT initiatives.
Understanding of processes and their benefits in a maturing IT environment.
Ability to learn newer security technologies, understand implementation requirements, and integrate technologies into a larger corporate solution.
Ability to translate real-world threats into actionable security tasks while balancing functionality and performance with prudent security measures, and to understand the implications of system security decisions.
At Level II, prior experience with architecture processes, strategies, and standards is required.
At Level II, experience coordinating vendor solution delivery and partnering effectively with vendors to meet business needs is required.
Ability to work prolonged periods sitting and/or standing at a workstation and using a computer.
Ability to sit and/or stand at a workstation while viewing a computer and using a keyboard, mouse, and/or phone for three or more hours at a time.
Ability to travel across the Health Plan service region for meetings and/or training as needed.
Ability to work in a home office for continuous periods for business continuity.

Nice To Haves

Experience with identity and access management architecture and implementation, user provisioning and de-provisioning, and single sign-on.
Experience with enterprise directories such as AD and LDAP.
Experience with multi-factor authentication.
Experience with network- and application-level security and encryption.
Experience with security event management.
Experience with firewall architecture and design.
Experience with cloud security controls.
Experience with web server security and application security.
Experience with PKI system implementation.
Experience with data loss prevention systems and implementation.
Experience with intrusion detection and prevention systems for network and host systems.
Experience with remote access security controls and mobile security.
Familiarity with Sarbanes Oxley, HIPAA, HCFA, PCI/DSS, and other regulations affecting security, as well as ISO 27001, NIST security standards, COBIT, and COSO.
At least one security industry certification, such as CISSP, CISA, CISM, or SANS certification.

Responsibilities

Participate in developing and implementing security architecture principles and standards aligned with organizational business strategy; at Level II, lead this work.
Drive adoption of and compliance with security standards across development and infrastructure teams, including contracted teams.
Create functional and technical security requirements and oversee them through the project lifecycle.
Execute the risk management strategy with business and divisional stakeholders, integrating risk management into operational, regulatory/statutory, financial, technical, and security processes, including disaster recovery and business continuity planning.
Perform risk-based assessments of solutions and vendors to verify appropriate security controls.
Provide security consultation, including design reviews and recommendations for projects and initiatives.
Provide hands-on support for technologies owned and operated by the Security and Risk Department.
Build collaborative relationships across divisions, the organization, and subsidiaries to manage information security risks and align solutions with business strategy.
Develop processes, standards, and templates for managing information security risks.
Support implementation of standards and solutions in collaboration with divisional teams to protect application and infrastructure assets.
Maintain high standards of integrity, support the company mission and values, and adhere to the Corporate Code of Conduct.
Protect member privacy in accordance with corporate privacy policies and procedures.
At Level II, help develop the overall risk management strategy with business and IT stakeholders and foster a risk management culture through education, skill development, and effective processes and practices.
At Level II, mentor department staff and provide subject matter expertise to the division.
Maintain regular and reliable attendance and perform other functions assigned by management.