Manager - IS Information Security GRC & Security Architecture

UHS•Tredyffrin Township, PA

About The Position

The Manager – Information Security GRC and Security Architecture manages the deployment and support of the Governance, Risk, and Compliance (GRC) program and cybersecurity architecture functions that support the security of electronic information, systems, networks, cloud environments, and business processes across all Corporate, BH and Acute Hospitals. Leads and supervises GRC and Security Architecture staff and resources to execute program activities and initiatives in alignment with the organization’s Information Security Management Systems, established policies, enterprise architecture standards, and regulatory requirements.

Requirements

Bachelor’s degree required.
5-8 years of progressive information security experience that includes 1-3 years management experience and / or 3 years of direct Information Security experience in a multi-facility Acute and BH Hospital environment.
Working knowledge of cybersecurity architecture principles, secure design patterns, cloud security architecture, identity and access management, network segmentation, endpoint protection, data protection, vulnerability management, and security control integration across enterprise technology environments.
Strong technical analytical skills, project management certification and/or experience, process improvement related to workflow processes, training, development of educational material.
Proven knowledge and experience developing and implementing a cybersecurity risk management framework based on regulations such as HIPAA or SOX and best practices as defined in NIST, ISO, PCI, and other common cybersecurity frameworks.
Ability to review proposed technology solutions, assess architectural risk, define security requirements, and partner with infrastructure, application, cloud, and business teams to embed security controls into solution designs.
Able to communicate clearly and respectfully with Executives, and all other personnel.
Strong process and technology analysis skills.
Ability to prioritize and balance multiple projects, priorities, or objectives.
Learns quickly, takes constructive feedback on performance, stays focused on the job with attention to detail and produces desired outcomes.

Nice To Haves

Healthcare industry experience preferred.

Responsibilities

Provides management of the implementation and ongoing support of corporate owned information security applications, cybersecurity architecture standards, and security controls.
Participates in leading security compliance (e.g., PCI compliance) initiatives to clearly identify control objectives and work with other teams to exceed audit objectives.
Exercises responsibility for supervision, performance evaluations and direction of team. Coordinates work assignments given in order to meet deadlines and ensure continued progress toward assignment completion.
Works with CISO to identify current and emerging threats to our systems and environment to prevent incidents where possible and actively manage them as necessary.
Works closely with CISO and other senior level personnel to further enhance and develop their leadership skills.
Continually evaluates the security posture and cybersecurity architecture of cloud, network, infrastructure, endpoint, application, and data environments against internal policy, regulatory requirements, enterprise standards, and industry best practices.