VP, Chief Information Security Officer

Beth Israel Lahey Health • Boston, MA

2d • $315,000 - $350,000

About The Position

This leadership role directs, develops, and manages the organization’s Cyber Security function. It is accountable for enterprise cyber security strategy, governance, architecture, operations, risk management, compliance, incident response, resilience, vendor risk, and workforce awareness, protecting clinical, business, research, and administrative systems and information while supporting safe and reliable patient care.

The role defines and drives enterprise cyber security policies, standards, investments, and performance measures across on-premises, cloud, digital health, EHR, ERP, data and analytics, connected medical device, and artificial intelligence environments. It establishes security and risk requirements for AI technologies, prepares the organization for AI-enabled threats, and drives the use of AI to combat security threats.

As a member of the IT senior leadership team, the role contributes to enterprise IT and business strategy, advises executive leadership and appropriate board committees on material cyber risk, and partners with Privacy, Compliance, Legal, Risk, Internal Audit, Clinical Operations, Clinical Engineering, Data and Analytics, Human Resources, Supply Chain, and other leaders to strengthen enterprise resilience.

Requirements

• Master’s degree in Cyber Security, Computer Science, Information Systems, Engineering, Business, Healthcare Administration, or a related field, and/or an equivalent combination of education and progressively responsible experience.
• Fifteen or more years of progressively responsible cyber security, information security, technology risk, or related experience.
• Seven or more years of leadership responsibility in complex environments, including experience advising executive leadership and governing bodies on material cyber risk.
• Demonstrated experience in enterprise cyber security strategy, governance, risk management, incident response, resilience, security architecture, cloud and identity security, third-party risk, organizational design, financial planning, and executive communication.
• Deep knowledge of the Cyber Security domain, including AI and generative AI security risks, AI governance, cloud and SaaS security, zero-trust architecture, security operations, data protection, application and API security, connected medical device security, and cyber resilience.

Nice To Haves

• One or more relevant credentials, such as CISSP, CISM, C-CISO, CRISC, HCISPP, GIAC, or a comparable security or executive credential.
• Health care experience.
• Knowledge of HIPAA/HITECH, the NIST Cybersecurity Framework, HHS health care cyber security guidance, the NIST AI Risk Management Framework, and applicable industry standards.
• Proven capability leading cyber security and risk initiatives in complex and dynamic environments.

Responsibilities

• Set the mission, vision, strategy, operating model, and multi-year roadmap for Cyber Security, aligning priorities with enterprise strategy, patient safety, digital transformation, risk appetite, and measurable risk reduction.
• Lead, manage, and develop Cyber Security capabilities, including security architecture and engineering, identity and access management, security operations, vulnerability management, governance, risk and compliance, third-party risk, incident response, and workforce education.
• Establish and maintain enterprise cyber security policies, standards, control frameworks, risk assessments, asset inventories, risk registers, exception processes, and performance measures aligned with applicable laws, regulations, contractual obligations, and recognized industry frameworks.
• Report and advise executive leadership and appropriate board committees on material cyber risks, emerging threats, regulatory obligations, control effectiveness, incident readiness, investment priorities, and remediation progress.
• Oversee security monitoring, threat intelligence, threat hunting, incident response, digital forensics, crisis coordination, ransomware preparedness, business continuity, disaster recovery, clinical downtime readiness, and post-incident improvement activities.
• Drive identity-first and zero-trust security practices and oversee protection of cloud, SaaS, endpoint, email, network, application, API, data, EHR, ERP, digital health, connected medical device, Internet of Medical Things, and operational technology environments.
• Co-lead enterprise AI governance and establish security requirements for the acquisition, development, deployment, monitoring, and retirement of AI, generative AI, machine learning, agent, copilot, and AI-enabled technologies.
• Maintain an inventory and risk-based oversight process for AI systems and address AI-related threats, including prompt injection, sensitive-data leakage, model theft or manipulation, data poisoning, insecure outputs, excessive agency, shadow AI, deepfakes, and AI-enabled phishing or malware.
• Drive the use of AI in combating security threats.
• Lead cyber security due diligence, contracting requirements, and ongoing monitoring for vendors, business associates, cloud providers, AI providers, software dependencies, strategic partners, and other critical third parties, including concentration, fourth-party, data-use, and continuity risks.
• Partner with internal functions and leaders to embed cyber security and responsible AI controls into procurement, architecture, system development, major implementations, mergers and affiliations, and technology lifecycle decisions.
• Recruit, develop, coach, and retain a high-performing cyber security team; maintain succession and workforce plans; promote an enterprise security culture; and build capabilities in cloud, identity, AI security, medical device security, incident response, and healthcare cyber risk.
• Maintain strict adherence to the BILH confidentiality policy and comply with BILH policies, Standards of Behavior, Guiding Principles, and departmental behavioral expectations.
• Maintain courteous and effective interactions with colleagues and patients.
• Participate in departmental and/or interdepartmental quality improvement activities and successfully complete Mandatory Education.
• Perform other duties as needed or directed to meet the needs of the department.
• Comply with the organization’s requirement that staff be vaccinated against influenza as a condition of employment.

Benefits

• May be eligible for additional compensation, which may include performance-based incentive bonuses.
• Staff influenza vaccination is required as a condition of employment.

What This Job Offers

• Job Type: Full-time
• Career Level: Executive