Director Information Security / CISO

Prosum; California; In loco; USD 117.000 - 124.000; Tempo pieno

Descrizione del lavoro

Prosum is seeking an experienced Chief Information Security Officer (CISO) to lead cybersecurity strategy, risk management, and regulatory compliance for enterprise healthcare IT systems.

The role requires deep operational security expertise, executive presence, and strong relationship management with clinical and business leaders. This is a contract-to-hire engagement based in Ventura, CA, with emphasis on NIST CSF/HIPAA controls, risk governance, and program maturity.

Competenze

• Bachelor’s degree in cybersecurity, IT, computer science, healthcare administration, business, or related discipline.
• 10+ years of progressive IT/security/risk experience with 5+ years leading cybersecurity teams or programs.
• Demonstrated experience with security operations, incident response, identity security, security architecture, and healthcare regulations.
• Strong executive communication and collaboration with Compliance, Privacy, clinical leaders, and shared-service providers.
• CISSP, CISM, CISA, CRISC, HCISPP or equivalent preferred.
• Annual cybersecurity strategy/roadmap refresh with portfolio delivery and reporting.
• Experience with HIPAA Security risk analyses and RAFT workflow.
• Regulatory deadlines met or escalated with evidence-based closure.

Mansioni

• Develop, execute, and refresh enterprise cybersecurity strategy and a multi-year roadmap.
• Oversee SOC/SIEM operations, incident response, threat intel, and vulnerability management.
• Lead identity and access security, MFA, RBAC, and reviews for EHR/clinical systems.
• Ensure HIPAA and healthcare regulations compliance across the IT landscape.
• Coordinate RAFT governance, remediation tracking, and management reporting.
• Provide executive dashboards on security posture, risk, and portfolio delivery.
• Collaborate with IT, clinical leaders, vendors, and regulators to balance risk and business needs.

Conoscenze

Cybersecurity leadership

Executive communication

Relationship management

Security operations

Incident response

Identity security

Security architecture

Formazione

Bachelor’s degree in cybersecurity, IT, computer science, healthcare administration, business, or related discipline

Advanced degree preferred

Descrizione del lavoro

## Director Information Security / CISO**Ventura,CA93001**Employment Type:Contract To HireJob Number: 25981Remote Options:## Job Description**Director Information Security/CISO** We are seeking an experienced Chief Information Security Officer (CISO) for a contract engagement to lead our cybersecurity and IT risk and compliance programs. The ideal candidate will bring **strong operational cybersecurity expertise, executive presence, and exceptional relationship management skills**. **Chief Information Security Officer (CISO)** Director of Information Security, IT Risk & Compliance | **Position Summary** The CISO is the executive leader responsible for developing, operating, and continuously improving enterprise information security and cybersecurity program. This role sets a risk-based, multiyear security strategy; oversees cybersecurity investments, initiatives, and daily operations; and safeguards patient care, sensitive information, clinical technologies, and essential health services. The CISO also owns security-related regulatory compliance and serves as the central IT liaison and gatekeeper for technology-related compliance issues originating with the Compliance Officer, Privacy, clinical and business operations, auditors, regulators, and leadership. The CISO manages intake, prioritization, risk visibility, RAFT tracking, remediation coordination, and timely escalation; technology and business owners remain responsible for executing and sustaining their assigned controls. **Essential Responsibilities** **1. Enterprise Cybersecurity Strategy, Program & Portfolio Leadership — 40%** • Develop, execute, and annually refresh an enterprise cybersecurity strategy, target-state security architecture, policies, standards, operating model, and risk-based three-to-five-year roadmap aligned with clinical operations, patient safety, business priorities, and NIST CSF/HIPAA Security requirements. • Own the enterprise cybersecurity portfolio: identify capability gaps; develop business cases and investment priorities; sponsor and govern security programs/projects; establish milestones, budgets, staffing/vendor plans, dependencies, measurable outcomes, and benefit realization; report progress and resolve delivery barriers. • Direct day-to-day security operations and continuous improvement across security monitoring/SOC and SIEM, incident detection and response, threat intelligence, endpoint/XDR, vulnerability and exposure management, patch-risk governance, security configuration, and penetration testing. • Lead identity and access security strategy, including MFA, privileged access, role-based access governance, periodic access reviews, and security controls for EHR and clinical systems; partner with application and infrastructure teams responsible for implementation. • Establish security architecture and control requirements for networks/segmentation, cloud, remote access, third parties, data protection/encryption, AI, IoMT/medical devices, and integration platforms; review major technology designs and changes. • Own cybersecurity incident readiness, ransomware resilience, security investigations and response coordination, cyber recovery requirements, tabletop exercises, and post-incident improvement; integrate with enterprise emergency management and disaster recovery owners. • Conduct enterprise security risk assessments and HIPAA Security Rule risk analyses; manage security policy compliance, security awareness, vendor cybersecurity risk, and remediation of security control gaps. • Build a security performance and maturity measurement program using KPIs/KRIs, control testing, roadmap delivery, incident trends, vulnerability aging, third-party exposure, and executive/board-ready reporting. • Coordinate security initiatives and operational service expectations with County IT, clinical engineering, application owners, and external partners, while preserving clear accountability for shared infrastructure and systems. **2. Enterprise IT Compliance Intake, Gatekeeping & Compliance Officer Partnership — 20%** • Serve as the primary IT relationship manager to the Agency Compliance Officer and central intake/triage point for technology-elated compliance issues; establish acknowledgment, classification, ownership, prioritization, communications, and closure standards. • Coordinate IT responses involving privacy-related controls, PCI DSS, access, records retention, accessibility, EHR billing/documentation, clinical-system regulations, CMS and California requirements, disaster recovery, County/Agency policies, investigations, and corrective actions. **3. Risk Registry, RAFT & Corrective-Action Governance — 15%** • Own the centralized IT compliance and technology risk registry and formal RAFT (Risk, Action, Follow-up, and Tracking) workflow, aligned with enterprise terminology and approved standards. • Record issue source, requirement, severity, patient/operational impact, accountable business/IT owners, interim safeguards, remediation plan, milestones, due dates, dependencies, evidence, residual risk, and authorized acceptance decisions. • Coordinate mitigation timelines and corrective actions with IT Directors; monitor aging, overdue items, resource constraints, validation evidence, and effectiveness through documented closure. • Prioritize jointly with the Compliance Officer and CIO based on patient safety, regulatory obligations, privacy, financial exposure, operational continuity, and feasibility; escalate risks appropriately. **4. Audit, Investigations & Regulatory Readiness — 10%** • Coordinate technology audit readiness, control assessments, technical evidence, system logs, investigation support, responses, management action plans, and verification of corrective actions. • Protect investigation confidentiality and evidence integrity; maintain Internal Audit independence and promptly refer reporting/notification deadlines to designated responsible officials. **5. Technology Risk, Resilience & Operational Control Oversight — 10%** • Assess security and technology risks for procurements, vendors, cloud, new clinical systems, integrations, AI, and connected medical devices. • Monitor risks related to change management, system access, asset/software licensing, EOL/EOS, backups, disaster recovery, continuity dependencies, vendor controls, and County-managed infrastructure; coordinate remediation with accountable operators. **6. Leadership, Executive Reporting & Collaboration — 5%** • Lead, coach, and develop cybersecurity and IT GRC personnel; manage program capacity, skills, vendor relationships, and performance. • Provide the CIO and Compliance Officer with dashboards covering security program maturity, cybersecurity portfolio delivery, threat/risk posture, compliance exposure, RAFT status, overdue actions, and remediation progress. • Participate in enterprise technology, clinical, risk, AI, and compliance governance; address issues at the appropriate level while promptly escalating material, patient-safety, legally reportable, or unresolved risks. **Decision Rights & Accountability** The CISO owns cybersecurity strategy, program delivery, security operations oversight, security-related compliance, and IT compliance intake/RAFT coordination. IT Directors, enterprise IT, and system owners own technical implementation and sustained operations. The Compliance Officer, Privacy Officer, Legal, clinical and business leaders retain their designated regulatory and business authorities. The CISO owns enterprise IT prioritization, resources, and executive technology-risk decisions; Internal Audit remains independent. **Qualifications** • Bachelor’s degree in cybersecurity, IT, computer science, healthcare administration, business, or related discipline; advanced degree preferred. • 10+ years of progressive IT/security/risk experience with 5+ years leading cybersecurity teams or programs; proven record building a mature enterprise security program and delivering a multiyear cybersecurity portfolio. • Demonstrated experience with security operations, incident response, identity security, security architecture, clinical/EHR environments, healthcare regulations, risk-based investment planning, and cross-functional remediation • Strong executive communication and collaboration with Compliance, Privacy, clinical leaders, and shared-service providers; healthcare/public-sector experience preferred. CISSP, CISM, CISA, CRISC, HCISPP or equivalent preferred. • Annual cybersecurity strategy/roadmap refresh; quarterly portfolio delivery and investment reporting against approved milestones. • Improved security maturity and measurable performance across threat detection/response, critical vulnerability remediation, access controls, third-party risk, and incident preparedness. • Documented annual HIPAA Security risk analysis and risk-based security remediation plans. • 100% of incoming material IT compliance issues registered, assigned, prioritized, and tracked. • Risk-ranked RAFT plans for material findings; monthly review of overdue actions with Compliance and IT leadership. • Regulatory deadlines met or escalated in advance; evidence-based closure and documented authorized risk acceptance. **Pay Range:** $85.00 - $90.00 per hour