Associate Director, Cyber Defense

The Ohio State University Wexner Medical Center; Columbus (OH); On-site; USD 140,000 - 200,000; Full time

Job summary

The Ohio State University Wexner Medical Center is seeking an Associate Director, Cyber Defense to lead the strategic development of the medical center's defensive security capabilities. You will report to the CISO and direct executive oversight of mSOC, vulnerability management, threat intelligence, and incident response programs.

You will align security initiatives with OSU OTDI and external vendors, maintain runbooks, and drive measurable improvements through controls validation of ISPCR.

Qualifications

• Education: Bachelor's degree in CS/IT/Cybersecurity or equivalent.
• 7 years progressive leadership experience in cybersecurity operations or engineering with supervisory duties.
• Experience in regulated environments (healthcare, higher education, government, or critical infrastructure).

Responsibilities

• Provide strategic vision and governance for the medical center's defensive security capabilities.
• Oversee governance of partner-led mSOC, Vulnerability Management, Threat Intelligence, and Incident Response.
• Align security programs with OSU OTDI and external vendors; manage runbooks and SLA delivery.
• Lead, mentor, and develop technical cybersecurity teams within a matrixed organization.
• Drive measurable, iterative controls validation of ISPCR across domains.
• Collaborate with senior leadership to translate threats into business risk.

Skills

Leadership

Vendor management

Incident command

Cross-functional collaboration

Communication

Education

Bachelor's degree in Computer Science / Information Technology / Cybersecurity

Master’s degree in Cybersecurity or related field

CISSP

CISM

Tools

NIST CSF

NIST 800-53

MITRE ATT&CK

CIS Controls

MSSP governance

Job description

Current Employees and Students: Please log in to Workday to use the internal job search and application process.

Job Description

The Associate Director, Cyber Defense is responsible for the strategic vision, governance, and maturation of the medical center's defensive security capabilities. Reporting directly to the OSUWMC Chief Information Security Officer (CISO), this role provides executive and operational oversight across four core pillars: governing our partner-led Managed Security Operations Center (mSOC), directing the enterprise Vulnerability Management program (encompassing IT, IoT, and medical IoT/mIoT devices), architecting a Threat Intelligence capability, and scaling the Incident Response (IR) function.

A primary focus of this role is establishing strategic alignment and seamless collaboration between OSUWMC departments, the OSU Office of Technology and Digital Innovation (OTDI), and external security vendors. The Associate Director ensures threat-driven defense by maintaining runbooks, optimizing vendor performance against SLAs, and spearheading active, measurable iterative controls validation of the Information Security and Privacy Control Requirements (ISPCR).

As a key member of the Information Security leadership team, this position requires an elevated level of autonomy, significant executive decision-making authority, and a proven track record of directly leading, mentoring, and growing technical cybersecurity teams. The Associate Director serves as a people leader responsible for driving staff engagement, fostering technical growth, and cultivating a high-trust team culture, alongside extensive experience steering third-party partners and cross-functional technical teams within a highly matrixed environment.

Required Qualifications

• Education: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or equivalent combination of education and experience.
• Experience: 7 years of progressive leadership experience in cybersecurity operations or engineering, with personnel management or supervisory experience leading technical teams.

Desired Qualifications

• Regulated Environments: Experience operating cybersecurity programs in highly regulated environments such as healthcare, higher education, government, or other critical infrastructure sectors.
• Advanced Degree: Master’s degree in Cybersecurity, Business Administration (MBA), Healthcare IT, or a related field.
• Certifications: Active industry-standard certifications such as:
  • Certified Information Systems Security Professional (CISSP)
  • Certified Information Security Manager (CISM)
• Frameworks & Standards: Working knowledge of NIST Cybersecurity Framework (CSF), NIST 800-53, MITRE ATT&CK, CIS Controls, and healthcare-specific security guidance.
• Vendor Management: Proven experience establishing governance frameworks for and holding third-party managed service providers (MSSP/mSOC) accountable via strict SLAs.
• Capability Architecture: Demonstrated success building, structuring, or significantly maturing cybersecurity functions (specifically Incident Response frameworks or Threat Intelligence programs) from the ground up.
• Incident Command: Hands-on experience leading incident command structures and coordinating responses to enterprise-wide security incidents, breaches, or advanced threats.
• Vulnerability Frameworks: Familiarity with modern vulnerability management concepts (risk-based prioritization vs. raw CVSS scoring) across enterprise and clinical environments.
• Communication & Collaboration: Exceptional relationship management skills with a track record of translating complex technical threats into quantifiable business risk for senior medical center and university leadership.

Screen reader users may encounter difficulty with the online application. For assistance with applying, please contact [e-mail]. If you have questions while submitting an application, please review these frequently asked questions.

Thank you for your interest in working at Ohio State.

Final candidates are subject to successful completion of a background check. A drug screen or physical may be required during the post offer process.

The university is an equal opportunity employer, including veterans and disability.