Information Security Architect

Excellus BCBS • Utica, NY

4d • $87,766 - $198,168

About The Position

The Information Security Architect assists with developing and executing the information security risk management strategy, risk assessment philosophy, and IT components of Lifetime Healthcare Companies’ Enterprise Risk Management program. The role participates in IT security investment analysis, design, scope, and approach. Its primary responsibility is to provide technical expertise to the Information Security Group and serve as a trusted security advisor for business and divisional initiatives, helping ensure secure, risk-based, and cost-effective infrastructure and application designs are developed and maintained. The position advises and consults with Information Security management and business and IT leadership on protecting corporate information and setting the direction of the Information Security Program.

At Level I, the architect contributes to security architecture principles and standards, promotes compliance, defines and follows security requirements through project lifecycles, performs risk assessments, consults on projects, supports security technologies, and builds collaborative relationships across the organization. The role also develops risk-management processes, standards, and templates and supports implementation of security solutions. At Level II, the architect additionally leads the development and implementation of security architecture principles and standards, helps develop the overall risk strategy, fosters a risk-management culture, and mentors department staff.

The position requires a minimum of five years of IT security experience at Level I, or seven years at Level II. A bachelor’s degree in computer science, information technology, or a relevant field is required, with six additional years of experience accepted in lieu of a degree. The role requires strong communication, collaboration, judgment, relationship-management, and security architecture skills. Preferred experience includes a range of enterprise security technologies and familiarity with applicable regulations and standards. Physical requirements include extended periods sitting or standing at a workstation and using a computer, possible travel within the Health Plan service region, and the ability to work from a home office for extended periods.

The posting lists compensation ranges of $87,766–$157,978 for Level I and $110,093–$198,168 for Level II. Other components of the total rewards package may include group health and/or dental insurance, a retirement plan, a wellness program, paid time away from work, and paid holidays. Remote work may be possible on a case-by-case basis.

Requirements

• At Level I, at least five years of experience in an Information Technology Security role; at Level II, at least seven years of related experience in such a role.
• Bachelor’s degree in computer science, information technology, or a relevant field; in lieu of a degree, six additional years of experience are required.
• Exceptional communication and influencing skills, including the ability to balance differing stakeholder interests through analysis and persuasion.
• Ability to collaborate with stakeholders inside and outside the organization.
• Strong knowledge of TCP/IP protocols and broad, deep conceptual understanding of applications, application platforms, operating systems, and networks.
• Experience with shell scripting, Perl, another scripting language, or a programming language such as Java, C++, or C.
• Demonstrated ability to work with a diverse team and help develop and shape the organization’s security architecture.
• Sound judgment, proven relationship-management skills, and ability to support security architecture aspects of business and IT initiatives.
• Understanding of processes and their benefits in a maturing IT environment.
• Ability to quickly learn newer security technologies, their implementation requirements, and how to integrate them into a larger corporate solution.
• Ability to translate real-world threats into actionable security tasks while balancing functionality and performance needs with prudent security measures, and to understand the ramifications of system security decisions.
• Ability to work prolonged periods sitting and/or standing at a workstation and working on a computer.
• Ability to sit and/or stand at a workstation while viewing a computer and using a keyboard, mouse, and/or phone for three or more hours at a time.
• Ability to travel across the Health Plan service region for meetings and/or trainings as needed.
• Ability to work in a home office for continuous periods of time for business continuity.

Nice To Haves

• Experience with identity and access management architecture and implementation, user provisioning/de-provisioning, and single sign-on.
• Experience with enterprise directories such as AD and LDAP.
• Experience with multi-factor authentication.
• Experience with network- and application-level security and encryption.
• Experience with security event management.
• Experience with firewall architecture and design.
• Experience with cloud security controls.
• Experience with web server security and application security.
• Experience with PKI system implementation.
• Experience with data loss prevention systems and implementation.
• Experience with intrusion detection and prevention systems for network and host systems.
• Experience with remote access security controls and mobile security.
• Familiarity with Sarbanes Oxley, HIPAA, HCFA, PCI/DSS, and other regulations impacting security, as well as ISO27001, NIST security standards, COBIT, and COSO.
• At Level II, prior experience with architecture processes, strategies, and standards is required.
• At Level II, experience coordinating vendor solution delivery and partnering effectively with vendors to meet business needs.
• At Level II, at least one security industry certification such as CISSP, CISA, CISM, or SANS is preferred.

Responsibilities

• Participate in developing and implementing security architecture principles and standards aligned with the organization’s business and strategy; at Level II, lead this work.
• Drive adoption of and compliance with security standards across internal and contracted development and infrastructure teams.
• Create functional and technical security requirements and follow them through the project lifecycle.
• Execute or help develop an overall risk-management strategy with business, divisional, and IT stakeholders, including integrating risk management into operational, regulatory/statutory, financial, technical, and security processes.
• Support creation of robust disaster recovery and/or business continuity plans.
• Perform risk-based assessments of solutions and vendors to ensure appropriate security controls are followed.
• Provide security consultation, design reviews, and recommendations for projects and initiatives.
• Provide hands-on support for technologies owned and operated by the Security and Risk Department.
• Build collaborative relationships across the division, organization, and subsidiaries to manage information security risks and align solutions with business strategy.
• Develop processes, standards, and templates for managing information security risks, and support implementation of standards and solutions with other divisional teams.
• Maintain integrity, uphold the corporate Code of Conduct and Lifetime Way values, and protect member privacy in accordance with corporate policies and procedures.
• Maintain regular and reliable attendance and perform other functions as assigned by management.
• At Level II, foster a risk-management culture through education, skill development, and effective processes and practices.
• At Level II, mentor department staff and provide subject matter expertise to the division.

Benefits

• Group health and/or dental insurance may be included in the total rewards package.
• Retirement plan may be included in the total rewards package.
• Wellness program may be included in the total rewards package.
• Paid time away from work may be included in the total rewards package.
• Paid holidays may be included in the total rewards package.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level