VP, Chief Information Security Officer

Beth Israel Lahey Health•Boston, MA

About The Position

The VP, Chief Information Security Officer directs, develops, and manages Beth Israel Lahey Health’s Cyber Security function. The role is accountable for enterprise cyber security strategy, governance, architecture, operations, risk management, compliance, incident response, resilience, vendor risk, and workforce awareness, protecting clinical, business, research, and administrative systems and information while supporting safe, reliable patient care. The position defines and drives enterprise cyber security policies, standards, investments, and performance measures across on-premises, cloud, digital health, EHR, ERP, data and analytics, connected medical device, and artificial intelligence environments. It establishes security and risk requirements for AI technologies, prepares the organization for AI-enabled threats, and drives the use of AI to combat security threats. As a member of the IT senior leadership team, the role contributes to enterprise IT and business strategy, advises executive leadership and appropriate board committees on material cyber risk, and partners across the organization to strengthen enterprise resilience. The position leads and develops the Cyber Security function and its capabilities, oversees security monitoring and incident readiness, and co-leads enterprise AI governance. It also leads cyber security due diligence and ongoing risk monitoring for critical third parties, embeds security and responsible AI controls into organizational and technology decisions, and builds a high-performing team and enterprise security culture. The role requires a master’s degree or an equivalent combination of education and progressively responsible experience, at least 15 years of relevant experience, and at least seven years of leadership responsibility in complex environments, including advising executive leadership and governing bodies on material cyber risk. Health care experience is strongly preferred. Relevant security or executive credentials and knowledge of applicable healthcare, cybersecurity, and AI risk frameworks are preferred.

Requirements

Master’s degree in Cyber Security, Computer Science, Information Systems, Engineering, Business, Healthcare Administration, or a related field, and/or an equivalent combination of education and progressively responsible experience.
At least 15 years of progressively responsible cyber security, information security, technology risk, or related experience.
At least seven years of leadership responsibility in complex environments, including experience advising executive leadership and governing bodies on material cyber risk.
Demonstrated experience in enterprise cyber security strategy, governance, risk management, incident response, resilience, security architecture, cloud and identity security, third-party risk, organizational design, financial planning, and executive communication.
Deep knowledge of the Cyber Security domain, including artificial intelligence and generative AI security risks, AI governance, cloud and SaaS security, zero-trust architecture, security operations, data protection, application and API security, connected medical device security, and cyber resilience.
Ability to comply with BILH confidentiality and other organizational policies and behavioral expectations, interact courteously and effectively with colleagues and patients, participate in quality improvement activities, and complete mandatory education.
Staff must be vaccinated against influenza as a condition of employment.

Nice To Haves

One or more relevant credentials, such as CISSP, CISM, C-CISO, CRISC, HCISPP, GIAC, or a comparable security or executive credential.
Health care experience.
Knowledge of HIPAA/HITECH, the NIST Cybersecurity Framework, HHS health care cyber security guidance, the NIST AI Risk Management Framework, and applicable industry standards.
Proven capability leading cyber security and risk initiatives in complex and dynamic environments.
Leadership competencies in coaching and developing others, driving results, emotional intelligence, leading change, systems thinking, and setting healthcare business strategy.

Responsibilities

Set the mission, vision, strategy, operating model, and multi-year roadmap for the Cyber Security function, aligning priorities with enterprise strategy, patient safety, digital transformation, risk appetite, and measurable risk reduction.
Lead, manage, and develop Cyber Security capabilities, including security architecture and engineering, identity and access management, security operations, vulnerability management, governance, risk and compliance, third-party risk, incident response, and workforce education.
Establish and maintain enterprise cyber security policies, standards, control frameworks, risk assessments, asset inventories, risk registers, exception processes, and performance measures.
Advise executive leadership and appropriate board committees on material cyber risks, emerging threats, regulatory obligations, control effectiveness, incident readiness, investment priorities, and remediation progress.
Oversee security monitoring, threat intelligence, threat hunting, incident response, digital forensics, crisis coordination, ransomware preparedness, business continuity, disaster recovery, clinical downtime readiness, and post-incident improvement.
Drive identity-first and zero-trust security practices and oversee protection of cloud, SaaS, endpoint, email, network, application, API, data, EHR, ERP, digital health, connected medical device, Internet of Medical Things, and operational technology environments.
Co-lead enterprise AI governance and establish security requirements for the acquisition, development, deployment, monitoring, and retirement of AI and AI-enabled technologies.
Maintain an inventory and risk-based oversight process for AI systems and address AI-related threats, including prompt injection, sensitive-data leakage, model theft or manipulation, data poisoning, insecure outputs, excessive agency, shadow AI, deepfakes, and AI-enabled phishing or malware.
Drive the use of AI in combating security threats.
Lead cyber security due diligence, contracting requirements, and ongoing monitoring for vendors, business associates, cloud providers, AI providers, software dependencies, strategic partners, and other critical third parties.
Partner with Privacy, Compliance, Legal, Risk, Internal Audit, Clinical, Research, Data and Analytics, Clinical Engineering, Supply Chain, and other leaders to embed cyber security and responsible AI controls into procurement, architecture, system development, major implementations, mergers and affiliations, and technology lifecycle decisions.
Recruit, develop, coach, and retain a high-performing cyber security team; maintain succession and workforce plans; promote an enterprise security culture; and build capabilities in cloud, identity, AI security, medical device security, incident response, and healthcare cyber risk.
Maintain adherence to BILH confidentiality policies, standards of behavior, guiding principles, and other policies; participate in quality improvement activities and mandatory education; and perform other duties as needed or directed.