Chief Information Security Off

AtlantiCare; Egg Harbor Township (NJ); On-site; USD 187,000 - 327,000; Full time

Benefits offered by this job

PTO

Medical insurance

Retirement plan

Disability coverage

Life insurance

Tuition reimbursement

FSAs

Wellness programs

Voluntary benefits

Job summary

AtlantiCare, based in New Jersey, seeks a Chief Information Security Officer to protect patients, workforce, data, clinical operations, and the organization's reputation from cyber risk. Reporting to the EVP, CIO, the CISO will set vision, strategy, governance, and operating model for information security and cyber resilience across the health system.

The role leads the enterprise Information Security Program, embedding security by design while enabling AtlantiCare's digital, cloud, data, and AI

Qualifications

• Ten or more years of progressive cybersecurity leadership.
• HIPAA, HITECH knowledge and healthcare regulatory experience.

Responsibilities

• Lead the enterprise information security program and governance.
• Advise executive leadership and the Board on risk posture and program performance.
• Oversee incident response and cyber risk mitigation across the organization.
• Manage security architecture across network, identity, cloud, data, and medical devices.

Skills

Executive leadership

Cybersecurity strategy

Board advisory

Risk management

Security architecture

Incident response

Vendor risk management

Education

Bachelor’s degree in Computer Science / Cybersecurity / Information Systems

Masters preferred

Tools

NIST CSF 2.0

Cloud security tools

Endpoint security tools

Job description

Chief Information Security Off

Job Description

The Chief Information Security Officer (CISO) is the enterprise executive accountable for protecting AtlantiCares patients, workforce, data, clinical operations, and reputation from cyber risk. Reporting to the EVP, Chief Information and Digital Officer, the CISO sets the vision, strategy, governance, and operating model for information security and cyber resilience across the health system. This leader translates complex threats, vulnerabilities, and regulatory obligations into clear business and patient-safety risk decisions for executive leadership and the Board.

The CISO leads the enterprise Information Security Program and team; establishes policy, architecture, controls, metrics, and accountability; and ensures readiness to prevent, detect, respond to, and recover from cyber incidents. Working across clinical, operational, technology, biomedical, legal, privacy, compliance, audit, emergency management, and vendor partners, the CISO embeds security by design while enabling AtlantiCares strategic, digital, cloud, data, and AI priorities. The role is both strategic and operational and requires sound judgment, calm leadership, executive presence, and the ability to influence outcomes across a complex, highly regulated environment.

Responsibilities

KEY RESPONSIBILITIES

• Enterprise strategy and governance: Develop and execute a multi-year information security and cyber resilience strategy, roadmap, operating model, and budget aligned with AtlantiCares strategic plan, enterprise risk appetite, and technology priorities.
• Executive and Board advisory: Serve as the principal cyber risk advisor to executive leadership and the Board, presenting the organizations risk posture, material threats, control maturity, investment priorities, risk-acceptance decisions, and program performance in clear business and patient-safety terms.
• Risk ownership and accountability: Establish governance that enables business and technology leaders to identify, understand, mitigate, accept, and document cyber risk at the appropriate level.
• Security program leadership: Lead the enterprise Information Security Program and ensure consistent, high-quality execution across governance, risk, compliance, architecture, engineering, operations, incident response, awareness, and third-party risk.
• Team and partner leadership: Recruit, develop, motivate, and retain a high-performing security team; set clear accountabilities and performance expectations; and oversee managed security service providers, consultants, and dotted-line resources.
• Policy and control framework: Maintain a practical, risk-based framework of policies, standards, procedures, and controls aligned with applicable laws, regulations, contractual obligations, and recognized practices including NIST CSF 2.0, HHS 405(d) HICP, and the HHS Healthcare and Public Health Cybersecurity Performance Goals.
• Regulatory assurance: Partner with Legal, Compliance, Privacy, Audit, and operational leaders to maintain compliance with HIPAA, HITECH, the HIPAA Security Rule, and applicable federal and state requirements; oversee assessments, remediation plans, evidence, and regulatory readiness.
• Security architecture and engineering: Establish security-by-design requirements across identity, network, endpoint, cloud, applications, data, integration, and emerging technologies, advancing zero trust, multifactor authentication, least privilege, privileged access management, segmentation, encryption, and secure configuration.
• Clinical and medical-device security: Partner with clinical, Biomedical Engineering, Facilities, and operational leaders to protect connected medical devices and clinical technology through accurate inventories, risk-based segmentation, vulnerability management, lifecycle planning, downtime safeguards, and security requirements in procurement.
• Threat and vulnerability management: Maintain awareness of the external threat environment and direct threat intelligence, exposure management, penetration testing, vulnerability prioritization, and remediation across technology and business owners.
• Incident response and crisis leadership: Lead the response to significant cyber incidents, including ransomware, data compromise, and extended technology downtime; coordinate executive, clinical, operational, legal, privacy, communications, insurance, and law‑enforcement activities; and ensure timely breach assessment, notification, and lessons learned.
• Cyber resilience and recovery: Partner with Technology, Emergency Management, and clinical operations to align disaster recovery, business continuity, backup protection, recovery testing, downtime procedures, and tabletop exercises with critical business and patient‑care priorities.
• Third‑party and supply‑chain risk: Establish a lifecycle process to assess and manage cyber risk associated with vendors, business associates, cloud providers, software, services, and other ecosystem partners; ensure appropriate security requirements, contractual protections, monitoring, and concentration‑risk decisions.
• Digital, cloud, data, and AI enablement: Embed proportionate security review into technology intake, procurement, architecture, development, and project delivery. Partner with Data and Analytics, Privacy, Legal, and operational leaders to govern AI tools and models, including data protection, access, acceptable use, monitoring, and third‑party risk.
• Human risk and security culture: Build an enterprise security culture through role‑based awareness, phishing simulations, executive and clinical education, targeted interventions for high‑risk users, and a network of security champions.
• Metrics and continuous improvement: Define meaningful key risk and performance indicators, including risk reduction, control coverage, resilience, vulnerability remediation, third‑party exposure, and workforce behavior; use results to prioritize resources and improve program maturity.
• External engagement: Maintain effective relationships with peers, Health‑ISAC, cyber insurance partners, law enforcement, CISA, HHS, and other relevant agencies to strengthen preparedness, information sharing, and response.
• Financial stewardship: Develop and manage the information security budget, investment portfolio, contracts, and vendor performance, ensuring resources are directed to the organizations highest risks and most critical capabilities.
• Professional leadership: Demonstrate sound judgment, integrity, urgency, discretion, customer focus, and composure under pressure. Communicate effectively with technical and non‑technical audiences and influence outcomes where formal authority may not exist.
• Adhere to AtlantiCare policies and procedures and perform other duties as assigned.

WORK ENVIRONMENT

This position requires sitting at a desk or computer a majority of the day, with frequent speaking, reaching, and reading.This position requires occasional lifting up to 20 lbs. This position requires availability outside normal business hours, including evenings, weekends, and holidays, to lead the response to significant security incidents.

REPORTING RELATIONSHIP

This position reports to the EVP, Chief Information and Digital Officer, provides regular cyber risk reporting to executive leadership and the Board, and supervises Information Security staff as assigned.

Qualifications

QUALIFICATIONS

EDUCATION: Bachelors degree in Computer Science, Cybersecurity, Information Systems, Business, Health Informatics, or a related field, or equivalent relevant experience, required. Masters degree preferred.

LICENSE/CERTIFICATION: CISSP or CISM strongly preferred; CRISC, CISA, CCSP, HCISPP, or comparable security, risk, cloud, or healthcare credentials are desirable.

EXPERIENCE: Ten or more years of progressive cybersecurity, information security, technology risk, or related experience, including at least five years leading teams, enterprise programs, or significant security functions. Health care experience and demonstrated knowledge of HIPAA, HITECH, the HIPAA Security Rule, health information privacy, and the operational and patient‑safety implications of cyber events are required.

The successful candidate will have experience advising executives or boards; leading incident response and recovery; managing regulatory, audit, and third‑party risk; establishing security architecture and controls across network, identity, endpoint, cloud, application, data, and medical‑device environments; and developing multi‑year strategy, budgets, metrics, and talent. Experience evaluating AI‑enabled platforms and securing major digital or clinical transformation programs is strongly preferred.

• Job Identification100934
• Job CategoryAdministration
• Job ScheduleFull time
• Job ShiftDay
• Pay Range$186,660-$326,655
• Holidays RequiredNo
• Weekends RequiredNo
• Hrs Per Week40
• Posting RequirementPost Int & Ext

Total Rewards at AtlantiCare

At AtlantiCare, we believe in supporting the whole person. Our market‑competitive Total Rewards package is designed to promote the physical, emotional, social, and financial well‑being of our team members. We offer a comprehensive suite of benefits and resources, including:

Generous Paid Time Off (PTO)

Medical, Prescription Drug, Dental & Vision Insurance

Retirement Plans with employer contributions

Short-Term & Long-Term Disability Coverage

Life & Accidental Death & Dismemberment Insurance

Tuition Reimbursement to support your educational goals

Flexible Spending Accounts (FSAs) for healthcare and dependent care

Wellness Programs to help you thrive

Voluntary Benefits, including Pet Insurance and more

Benefits offerings may vary based on position and are subject to eligibility requirements.

Join a team that values your well‑being and invests in your future.

Pay Transparency

In order to support the Fair Compensation Strategy by the US Govt., HR Dept., clients are required to adhere to "Pay Transparency Law" in impacted states, which mandate employers to list salary ranges in job advertisements and promotions.

AtlantiCare is an Equal Opportunity Employer

Equal employment opportunity, including veterans and individuals with disabilities.

PI287555806