Senior Director, Identity & Risk Management

Availity

17h • Remote

About The Position

Availity is seeking an accomplished technology leader to join its information security leadership team as Senior Director, Identity & Risk Management. Reporting to the CISO, this role leads Workforce and Client Identity & Access Management, Governance, Risk & Compliance (GRC), and Fraud Investigations. The position manages approximately four direct reports and a globally diverse matrix organization of 30–35 associates, and partners with a Deputy CISO whose areas include Application Security, Security Operations & Cyber Defense, and Cloud Security.

The Senior Director establishes and maintains the enterprise information security vision, strategy, and multi-year roadmap to protect Availity’s information assets and customer information. The role communicates security strategy to executive management and the Audit and Compliance Board, promotes security practices across the business, and helps advance the security program in a healthcare technology environment. This is a remote US position. Sponsorship is not available, and travel of 10–15% is expected.

The role works with senior leaders to assess acceptable risk, presents risks and security program information to executive and Board audiences, oversees policies and compliance, and directs the evaluation and implementation of security solutions. It also oversees vulnerability and intrusion detection reporting, audit remediation, incident response, security metrics, and vendor and third-party risk management.

Requirements

• Bachelor’s degree in computer science, engineering, a related field, or equivalent experience.
• 10+ years of IT and/or business leadership experience.
• 5+ years of information security/cybersecurity experience.
• Proven experience delivering quality solutions in a SaaS environment.
• Understanding of Cloud, SaaS, and IoT architectures and their implications for information security strategy, including experience creating appropriately secure cloud operating environments.
• Proven experience leading globally diverse teams and working closely with C-suite executives.
• Track record of developing information security policies and procedures and successfully executing them.
• Extensive knowledge of business risk, risk assessment, and risk-based decision-making.
• Ability to communicate security- and risk-related concepts in business terms to technical and non-technical audiences, including Board-level audiences.
• Proven ability to address and present information to a Board of Directors and/or executive leadership team.
• Ability to influence, build coalitions, and build high-performing teams.
• Ability to inspire and motivate cross-functional, interdisciplinary teams to achieve tactical and strategic goals; innovative leadership, problem-solving, and consulting abilities.
• Ability to evangelize IT security as a critical part of business operations and build trust and respect for the security function.
• Excellent written and verbal communication, interpersonal, and collaborative skills.
• Experience with contract and vendor negotiations.
• Experience in incident and crisis management, including prioritizing and executing tasks in high-pressure situations.
• Knowledge of security, risk, and control frameworks and standards such as HITRUST, ISO 27001 and 27002, SANS-CAG, NIST, FISMA, COBIT, COSO, and ITIL.
• Technical acumen including OSI, IT infrastructure, cloud, application development languages, tools and frameworks, database technologies, web technologies, next-generation mobile, network architecture, enterprise architecture, and directory services.
• Security technology acumen and experience, including firewalls, intrusion detection, cyberattack tools and defenses, encryption, certificate authorities, web filtering, anti-malware, anti-phishing, identity and access management, and multi-factor authentication.
• Ability to travel 10–15%.
• Must be able to use a camera for all virtual meetings; video participation is required.

Nice To Haves

• Healthcare technology industry experience, including payer and provider spaces.
• Professional certifications such as CISSP, CISM, or CISA.

Responsibilities

• Lead a team of four direct reports and a matrix organization of 30–35 globally diverse associates.
• Develop and implement a strategic, long-term information security strategy and roadmap to protect Availity’s information assets and customer assets under its management.
• Work with senior leaders across the business to assess and communicate acceptable levels of risk.
• Identify, evaluate, and report information security risks, practices, and projects to the Executive Committee and Board of Directors; provide expertise on security standards and best practices.
• Develop, mentor, and manage a high-performing staff of information security professionals.
• Develop the Board’s understanding of security beyond a compliance-only view.
• Lead development of information security policies, procedures, standards, and guidelines, and oversee their approval, dissemination, and maintenance.
• Ensure the security management program complies with applicable laws, regulations, and contractual requirements.
• Champion the enterprise information security program and foster a security-aware culture.
• Oversee evaluation, selection, and implementation of innovative, cost-effective, minimally disruptive information security solutions.
• Partner with enterprise architecture, infrastructure, and application teams to ensure technologies are developed and maintained in accordance with security policies and guidelines.
• Manage intrusion detection and vulnerability reporting, internal and external IT audit reviews, and coordination of required fixes.
• Develop business metrics to measure security program effectiveness and increase program maturity over time.
• Monitor industry and external environments for emerging threats and advise stakeholders on appropriate actions.
• Liaise with law enforcement and advisory bodies as necessary to maintain a strong security posture.
• Oversee incident response planning and security breach investigations, assisting with related disciplinary, public relations, and legal matters.
• Oversee and lead creation, communication, and implementation of processes for managing vendor and other third-party risk.
• Communicate security strategy to executive management and the Audit and Compliance Board, and evangelize security best practices across the business.

Benefits

• Competitive salary and bonus structure.
• Company HSA contribution.
• Healthcare, vision, and dental benefits.
• 401(k) match program available on day one.
• Unlimited PTO for salaried associates and nine paid holidays.
• Gym membership, racing event, weight management program, and other wellness reimbursements up to $250 per year.
• Education reimbursement.
• Paid parental leave for birth and adoptive parents, including both mothers and fathers.
• Diversity and inclusion groups and opportunities to participate in company culture and community volunteering.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior