Information Security Manager

Avita Care Solutions • UNAVAILABLE, UNAVAILABLE

3d

About The Position

The Information Security Manager protects patient information and the systems supporting care across Avita Care Solutions and Q Care Plus. The role owns day-to-day execution of the security program in support of the SVP, Enterprise Technology and enterprise goals, combining hands-on security operations, governance, risk and compliance (GRC), third-party risk management (TPRM), provider oversight, and team development.

The manager advances an established Vulnerability Management Program as the organization transitions to separate managed service, security service, and network/connectivity providers. The role coordinates remediation ownership, policy timelines, verification, evidence, exceptions, and escalations across external providers and internal technical owners. It also manages day-to-day security-provider relationships and outcomes, IT service management (ITSM) workflow requirements, GRC and TPRM processes, and operational incident response.

The position leads and develops the Information Security team, including coaching the Junior Information Security Engineer, while working closely with the SVP, Enterprise Technology, CTO, peer directors, providers, Compliance, Legal, and internal technical owners. The SVP and CTO set strategy and priorities; authorized leadership approves budgets and contracts and accepts enterprise risk. Work hours are 8 a.m.–5 p.m., Monday through Friday, with flexibility, and occasional travel is required.

Requirements

• A relevant degree or equivalent professional experience.
• Demonstrated success building and operating a security program and turning vulnerabilities and risk decisions into assigned work and verified outcomes.
• Hands-on judgment across infrastructure, endpoints, identity, networks, and cloud to investigate findings, assess recommendations, and validate remediation.
• Practical experience in incident response, GRC, control evidence, TPRM, and ITSM workflow design and testing.
• Effective team coaching, cross-functional influence, and external-provider management, including service reviews and constructive escalation.
• Strong prioritization, problem-solving, and communication skills.
• Ability to lead program, team, and provider execution while remaining technically engaged.
• Ability to work 8 a.m.–5 p.m., Monday through Friday, with flexibility.
• Ability to travel occasionally.

Nice To Haves

• Healthcare security experience; strong candidates from regulated industries are also welcome.
• Prior Director-level experience, although appropriate program, team, and provider leadership may qualify.
• CISSP, CISM, or a comparable certification; certification is not required with adequate experience.
• CRISC certification is an additional advantage.

Responsibilities

• Advance the established Vulnerability Management Program as the organization transitions to separate MSP, MSSP, and network/connectivity providers.
• Apply vulnerability-management policies to prioritize findings, assign remediation owners, track timelines, validate evidence and closure, document exceptions, and escalate unresolved issues.
• Lead hands-on investigation and constructively challenge and validate remediation with providers and internal technical owners.
• Own the day-to-day security-service relationship with the MSSP and coordinate security responsibilities with the MSP and network/connectivity providers.
• Conduct provider service reviews, check monitoring and vulnerability coverage, test escalation paths, and follow improvement actions through completion.
• Evaluate provider recommendations using follow-up questions, evidence, and verification; monitor commitments and report outcomes, gaps, and decisions needed.
• Own vendor workflow design and integration requirements in the ITSM platform, including handoffs, acceptance criteria, and end-to-end tests.
• Ensure MSSP findings reach the correct provider or internal owner and return with visible status, remediation evidence, verification, and escalation.
• Manage day-to-day GRC and TPRM platforms and processes, including risk registers, control evidence, vendor assessments, security documentation, and remediation follow-through.
• Partner with control owners and Compliance to support audits, security questionnaires, and practical policy enforcement; assess evidence and recommend resolutions for gaps.
• Lead operational response during significant security incidents by coordinating investigation, containment, and recovery with technical owners and providers, maintaining status and evidence, and driving post-incident improvements.
• Coordinate with Compliance and Legal on privacy and legal determinations; HIPAA breach determinations, breach logs, regulatory reporting, and notifications remain with those functions as applicable.
• Partner with the SVP, Enterprise Technology and CTO on evidence-based roadmap and investment recommendations, then translate approved plans into practical work and reporting.
• Lead the Information Security team and collaborate with peer directors and provider leaders through dotted-line security oversight.
• Coach and develop the Junior Information Security Engineer through hands-on investigation, technical judgment, evidence review, and increasing ownership.
• Set clear expectations, remove obstacles, provide constructive feedback, and remain engaged with technical findings while using providers effectively.

Benefits

• Medical, dental, and vision healthcare benefits for eligible team members and their families, plus additional company-paid and voluntary benefits.
• Six company-paid holidays and three personal floating holidays.
• Paid time off and paid leaves, including two weeks of paid parental leave, bereavement leave, sick leave, time to vote, and jury duty.
• Award recognition program and professional learning and development opportunities.
• Company-paid basic life and AD&D insurance.
• Maven and Health Care Advocate Work/Life Balance Program.
• Health and dependent flexible spending accounts.
• Voluntary long- and short-term disability, pet insurance, legal, accident, hospital indemnity, critical illness, whole and supplementary life insurance, and identity theft protection.
• 401(k) retirement savings plan with company match.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed