VP -Chief Security Officer

Brighton Health Plan Solutions, LLC•Westbury, NY

About The Position

The Chief Information Security Officer (CISO) and Senior Vice President of Enterprise Infrastructure serve as a senior technology executive responsible for the strategic direction, governance, operational resilience, cybersecurity posture, technology infrastructure, cloud transformation, and regulatory compliance of the enterprise. Reporting directly to the Chief Information Officer (CIO), this executive provides regular updates to the Board of Directors, Audit Committee, and Risk Committee on cybersecurity, technology risk, audit, compliance, operational resilience, and infrastructure performance. The CISO, SVP, is responsible for enterprise-wide cybersecurity strategy, technology risk management, infrastructure operations, cloud services, cloud security, disaster recovery, business continuity, regulatory compliance, incident response, and critical technology services supporting the organization's mission-critical operations. This role serves as the primary executive responsible for safeguarding corporate assets, customer information, regulated data, and critical business systems, and for ensuring compliance with applicable regulatory, contractual, and industry requirements. The executive leads an organization spanning Cybersecurity, Infrastructure Engineering, Cloud Services, Network Operations, Service Desk, Identity and Access Management, Security Operations, Governance, Risk & Compliance, Business Continuity, Disaster Recovery, Enterprise Architecture, Technology Operations, and Cloud Security. The role partners closely with executive leadership, regulators, auditors, customers, and board committees to ensure effective governance, risk oversight, operational resilience, and technology modernization across the enterprise. Executive Impact This position serves as the accountable executive for enterprise cybersecurity, infrastructure operations, cloud transformation, cloud security, technology risk management, operational resilience, SOC 1 and SOC 2 audit programs, HIPAA compliance, business continuity, disaster recovery, service desk, and customer assurance programs. The role is responsible for protecting the organization's technology ecosystem, maintaining regulatory compliance, supporting business growth, enabling digital transformation, and ensuring the resilience and security of all enterprise information assets and technology platforms.

Requirements

Executive-Level Position
Enterprise-Wide Accountability
Global Operations Responsibility
Direct CIO Reporting on Relationship
Regular Board, Audit Committee, and Risk Committee Presentation creation
Executive Sponsor for Enterprise Cybersecurity and Operational Resilience Programs
Primary Technology Risk Advisor to Executive Leadership and Committees
Regulatory Examination Ownership
Critical Infrastructure Oversight
Enterprise Ownership of SOC 1 and SOC 2 Audit Programs
Executive Accountability for HIPAA Security Compliance
Regulatory and Customer Assurance Program Leadership
Board-Level Audit and Compliance Reporting
Enterprise Risk Management and Cyber Resilience Leadership
Executive Ownership of Enterprise Cloud Migration and Cloud Transformation Strategy
Accountability for Multi-Cloud Architecture, Governance, and Operational Excellence
Executive Ownership of Cloud Security Strategy, Governance, and Risk Management
Responsibility for Cloud Security Architecture, Security Engineering, and Secure-by-Design Standards
Oversight of Cloud Compliance Programs, Cloud Control Frameworks, and Regulatory Readiness
Executive Leadership of Zero Trust, Identity Security, and Data Protection Initiatives Across Cloud Platforms
Accountability for Cloud Financial Management, Optimization, and Technology Modernization Programs
Enterprise Environment Supporting Approximately 1,000 Employees
Annual Technology Budget Responsibility
Enterprise Technology Vendor and Services Portfolio Oversight
Executive Ownership of Business Continuity and Disaster Recovery Programs
24x7 Mission-Critical Operations Accountability

Responsibilities

Serve as a senior technology executive responsible for cybersecurity, infrastructure, service desk, operational resilience, technology risk, and regulatory compliance.
Advise executive leadership and board committees on cybersecurity threats, emerging technologies, operational risk, cloud transformation initiatives, and regulatory obligations.
Establish enterprise technology and cybersecurity strategies aligned with organizational objectives and risk tolerance.
Lead executive-level cyber incident response, crisis management, and technology resilience activities.
Provide regular board-level reporting on cybersecurity, infrastructure performance, cloud transformation progress, compliance posture, and enterprise risk.
Own enterprise cybersecurity strategy, governance, risk management, and security operations.
Maintain accountability for cyber risk management frameworks, policies, standards, and controls.
Direct Security Operations, Threat Intelligence, Vulnerability Management, Incident Response, Identity Governance, Security Engineering, and Data Protection programs.
Oversee third-party risk management, vendor security assessments, and supply chain security initiatives.
Lead enterprise cyber resilience programs and security modernization initiatives.
Establish and maintain Zero Trust security principles across enterprise environments.
Lead all enterprise infrastructure operations including cloud platforms, networks, telecommunications, compute, storage, endpoint services, and enterprise technology platforms.
Direct infrastructure engineering and operational excellence programs supporting mission-critical services.
Maintain accountability for system availability, capacity planning, operational performance, and technology resilience.
Establish long-term infrastructure strategies supporting organizational growth and modernization.
Own the enterprise cloud migration strategy, roadmap, execution, and governance across public, private, and hybrid cloud environments.
Lead large-scale cloud modernization initiatives involving application migration, infrastructure transformation, platform engineering, and operational optimization.
Establish and maintain enterprise cloud security standards, controls, architectures, and governance frameworks.
Direct cloud security architecture, cloud security posture management, workload protection, container security, and cloud-native security operations.
Ensure cloud environments meet regulatory, privacy, audit, and customer assurance requirements.
Partner with executive leadership to align cloud transformation investments with business objectives, operational resilience requirements, and cybersecurity risk management strategies.
Serve as the executive owner for enterprise compliance, audit readiness, and assurance programs.
Maintain executive accountability for successful completion of cybersecurity, infrastructure, and operational control audits.
Direct the design, implementation, testing, and continuous improvement of internal controls supporting regulatory and compliance obligations.
Lead interactions with external auditors, regulators, customers, and executive stakeholders regarding technology risk, cybersecurity controls, and compliance posture.
Provide regular audit, compliance, and risk reporting to executive leadership and board committees.
Executive owner for SOC 1 and SOC 2 compliance programs, including governance, control effectiveness, audit coordination, remediation management, and annual certification activities.
Executive owner for HIPAA Security Rule compliance, ensuring the confidentiality, integrity, and availability of protected health information (PHI).
Oversee enterprise-wide risk assessments, control testing, policy governance, and corrective action programs associated with SOC, HIPAA, and related compliance frameworks.
Ensure alignment of cybersecurity and infrastructure controls with regulatory requirements, industry standards, contractual obligations, and customer assurance commitments.
Maintain accountability for audit findings, management responses, remediation plans, and ongoing compliance monitoring activities.
Maintain enterprise-wide business continuity and disaster recovery capabilities.
Direct crisis management, incident management, recovery planning, and resilience testing programs.
Ensure recovery capabilities meet business and regulatory requirements.
Oversee critical infrastructure protection and operational continuity strategies.
Manage enterprise technology and cybersecurity operating and capital budgets.
Lead a multidisciplinary organization supporting cybersecurity, infrastructure, cloud services, engineering, compliance, service desk and technology operations.
Oversee strategic technology vendor relationships, managed service providers, and enterprise technology contracts.
Drive technology investment strategies, modernization efforts, and operational efficiencies.