VP - Chief Information Security Officer

Prisma Health•Greenville, SC

About The Position

Responsible for the organization’s Information Security Program, including daily IT security operations, integrated risk management, oversight of annual and ongoing risk assessments, development and maintenance of policies and procedures, protection of electronic protected health information, compliance monitoring, and investigation and tracking of incidents and breaches in accordance with federal and state law. Serves as the health system’s designated security official under the HIPAA Security Rule. Builds and maintains a strategic information security program and promotes security awareness across the organization. Oversees security reviews of existing and new infrastructure systems and works with senior leaders and relevant partners on security governance, compliance, incident response, and risk mitigation. The role has direct reports and is considered part of management staff at Prisma Health or an affiliate.

Requirements

Bachelor’s degree in Information Systems or a related field of study.
Ten years of health industry IT and information security management experience.
Certified Information Systems Security Professional (CISSP) certification.
Knowledge of state and federal information security laws and regulations, including HIPAA, NIST, PCI, and other applicable requirements.
Familiarity with healthcare legislation and standards for protecting health information and patient security.
Computer skills, including word processing, spreadsheets, databases, and data entry.
Mathematical skills.
Communication skills.
Collaboration and problem-solving skills.
Knowledge of office equipment.

Responsibilities

Build, develop, maintain, and implement a strategic information security program, policies, and processes that minimize risk and protect the integrity, confidentiality, and availability of organizational information.
Ensure information security policies, standards, and procedures remain up to date.
Oversee and collaborate on architectural security design reviews of existing and new infrastructure systems, including identity and access management, networking, systems platforms, medical devices, IaaS, PaaS, and SaaS services.
Promote a culture of cybersecurity within ITS and drive security-related behavioral changes across the health system.
Initiate and promote information security awareness activities.
Evaluate security trends, threats, risks, and vulnerabilities and apply tools to mitigate risk.
Manage security incidents and events involving ePHI, PII, and corporate sensitive data.
Ensure disaster recovery, business continuity, and incident response plans are maintained and tested according to policy.
Ensure the health system and joint venture partners comply with administrative, technical, and physical safeguards.
Collaborate with senior management, the Privacy Officer, and the Corporate Compliance Officer to establish security program governance and keep the Board of Directors informed.
Partner with Human Resources and the Privacy Officer to ensure consistent sanctions for security violations.
Cooperate with federal and state regulators, law enforcement, and other legal entities in compliance reviews or investigations.
Perform other duties as assigned.
Supervise team members, including direct reports, with applicable budget, hiring and termination, performance appraisal, and disciplinary responsibilities.