Director Information Security / CISO

Prosum; Ventura (CA); Ibrido; USD 117.000 - 124.000; Tempo pieno

Descrizione del lavoro

Prosum is seeking an experienced Chief Information Security Officer (CISO) to lead enterprise cybersecurity, risk, and compliance programs in a Ventura, CA onsite setting (onsite 3 days/week). The contract spans 6 months with potential hire.

The ideal candidate will drive a risk-based security strategy across IT, clinical systems, and data protection, ensuring HIPAA compliance and strong governance. The CISO will own security operations, regulatory readiness, and RAFT-style governance,

Competenze

• Bachelor’s degree in cybersecurity, IT, computer science, healthcare administration, business, or related discipline.
• 10+ years of IT/security/risk experience with 5+ years leading cybersecurity teams or programs.
• Demonstrated experience with security operations, incident response, identity security, and clinical environments.
• Strong executive communication and collaboration with Compliance, Privacy, clinical leaders and shared-service providers.
• CISSP, CISM, CISA, CRISC, HCISPP or equivalent preferred.

Mansioni

• Develop and refresh an enterprise cybersecurity strategy and three-to-five-year roadmap aligned with clinical operations and NIST/HIPAA requirements.
• Oversee security operations, SOC, SIEM, incident response, threat intel, and vulnerability management.
• Lead identity and access security strategy, MFA, privileged access, and RBAC for EHR and clinical systems.
• Establish security architecture for networks, cloud, data protection, and medical devices; review major designs.
• Own cybersecurity incident readiness, tabletop exercises, and post-incident improvements.
• Coordinate compliance intake with HIPAA, PCI DSS, CMS, California requirements, and governance with the Compliance Officer.

Conoscenze

Executive leadership

Security operations

Regulatory compliance

HIPAA knowledge

Risk management

Strategic planning

Formazione

Bachelor’s degree in cybersecurity, IT, CS, healthcare administration, business, or related discipline

Strumenti

CISSP/CISM/CISA CRISC HCISPP certification

Descrizione del lavoro

Title: Director Information Security/CISO

Location: Ventura, CA (onsite 3 days/week)

Duration: 6 month contract to hire

Compensation: $85-90/hour

We are seeking an experienced Chief Information Security Officer (CISO) for a contract engagement to lead our cybersecurity and IT risk and compliance programs. The ideal candidate will bring strong operational cybersecurity expertise, executive presence, and exceptional relationship management skills.

Position Summary

The CISO is the executive leader responsible for developing, operating, and continuously improving enterprise information security and cybersecurity program. This role sets a risk-based, multiyear security strategy; oversees cybersecurity investments, initiatives, and daily operations; and safeguards patient care, sensitive information, clinical technologies, and essential health services.

The CISO also owns security-related regulatory compliance and serves as the central IT liaison and gatekeeper for technology-related compliance issues originating with the Compliance Officer, Privacy, clinical and business operations, auditors, regulators, and leadership. The CISO manages intake, prioritization, risk visibility, RAFT tracking, remediation coordination, and timely escalation; technology and business owners remain responsible for executing and sustaining their assigned controls.

1. Enterprise Cybersecurity Strategy, Program & Portfolio Leadership — 40%

• Develop, execute, and annually refresh an enterprise cybersecurity strategy, target-state security architecture, policies, standards, operating model, and risk-based three-to-five-year roadmap aligned with clinical operations, patient safety, business priorities, and NIST CSF/HIPAA Security requirements.
• Own the enterprise cybersecurity portfolio: identify capability gaps; develop business cases and investment priorities; sponsor and govern security programs/projects; establish milestones, budgets, staffing/vendor plans, dependencies, measurable outcomes, and benefit realization; report progress and resolve delivery barriers.
• Direct day-to-day security operations and continuous improvement across security monitoring/SOC and SIEM, incident detection and response, threat intelligence, endpoint/XDR, vulnerability and exposure management, patch-risk governance, security configuration, and penetration testing.
• Lead identity and access security strategy, including MFA, privileged access, role-based access governance, periodic access reviews, and security controls for EHR and clinical systems; partner with application and infrastructure teams responsible for implementation.
• Establish security architecture and control requirements for networks/segmentation, cloud, remote access, third parties, data protection/encryption, AI, IoMT/medical devices, and integration platforms; review major technology designs and changes.
• Own cybersecurity incident readiness, ransomware resilience, security investigations and response coordination, cyber recovery requirements, tabletop exercises, and post-incident improvement; integrate with enterprise emergency management and disaster recovery owners.
• Conduct enterprise security risk assessments and HIPAA Security Rule risk analyses; manage security policy compliance, security awareness, vendor cybersecurity risk, and remediation of security control gaps.
• Build a security performance and maturity measurement program using KPIs/KRIs, control testing, roadmap delivery, incident trends, vulnerability aging, third-party exposure, and executive/board-ready reporting.
• Coordinate security initiatives and operational service expectations with County IT, clinical engineering, application owners, and external partners, while preserving clear accountability for shared infrastructure and systems.

2. Enterprise IT Compliance Intake, Gatekeeping & Compliance Officer Partnership — 20%

• Serve as the primary IT relationship manager to the Agency Compliance Officer and central intake/triage point for technology-related compliance issues; establish acknowledgment, classification, ownership, prioritization, communications, and closure standards.
• Coordinate IT responses involving privacy-related controls, PCI DSS, access, records retention, accessibility, EHR billing/documentation, clinical-system regulations, CMS and California requirements, disaster recovery, County/Agency policies, investigations, and corrective actions.

3. Risk Registry, RAFT & Corrective-Action Governance — 15%

• Own the centralized IT compliance and technology risk registry and formal RAFT (Risk, Action, Follow-up, and Tracking) workflow, aligned with enterprise terminology and approved standards.
• Record issue source, requirement, severity, patient/operational impact, accountable business/IT owners, interim safeguards, remediation plan, milestones, due dates, dependencies, evidence, residual risk, and authorized acceptance decisions.
• Coordinate mitigation timelines and corrective actions with IT Directors; monitor aging, overdue items, resource constraints, validation evidence, and effectiveness through documented closure.
• Prioritize jointly with the Compliance Officer and CIO based on patient safety, regulatory obligations, privacy, financial exposure, operational continuity, and feasibility; elevate risks appropriately.

4. Audit, Investigations & Regulatory Readiness — 10%

• Coordinate technology audit readiness, control assessments, technical evidence, system logs, investigation support, responses, management action plans, and verification of corrective actions.
• Protect investigation confidentiality and evidence integrity; maintain Internal Audit independence and promptly refer reporting/notification deadlines to designated responsible officials.

5. Technology Risk, Resilience & Operational Control Oversight — 10%

• Assess security and technology risks for procurements, vendors, cloud, new clinical systems, integrations, AI, and connected medical devices.
• Monitor risks related to change management, system access, asset/software licensing, EOL/EOS, backups, disaster recovery, continuity dependencies, vendor controls, and County-managed infrastructure; coordinate remediation with accountable operators.
• Lead, coach, and develop cybersecurity and IT GRC personnel; manage program capacity, skills, vendor relationships, and performance.
• Provide the CIO and Compliance Officer with dashboards covering security program maturity, cybersecurity portfolio delivery, threat/risk posture, compliance exposure, RAFT status, overdue actions, and remediation progress.
• Participate in enterprise technology, clinical, risk, AI, and compliance governance; address issues at the appropriate level while promptly escalating material, patient-safety, legally reportable, or unresolved risks.

Decision Rights & Accountability

The CISO owns cybersecurity strategy, program delivery, security operations oversight, security-related compliance, and IT compliance intake/RAFT coordination. IT Directors, enterprise IT, and system owners own technical implementation and sustained operations. The Compliance Officer, Privacy Officer, Legal, clinical and business leaders retain their designated regulatory and business authorities. The CISO owns enterprise IT prioritization, resources, and executive technology-risk decisions; Internal Audit remains independent.

Qualifications

• Bachelor’s degree in cybersecurity, IT, computer science, healthcare administration, business, or related discipline; advanced degree preferred.
• 10+ years of progressive IT/security/risk experience with 5+ years leading cybersecurity teams or programs; proven record building a mature enterprise security program and delivering a multiyear cybersecurity portfolio.
• Demonstrated experience with security operations, incident response, identity security, security architecture, clinical/EHR environments, healthcare regulations, risk-based investment planning, and cross-functional remediation
• Strong executive communication and collaboration with Compliance, Privacy, clinical leaders, and shared-service providers; healthcare/public-sector experience preferred. CISSP, CISM, CISA, CRISC, HCISPP or equivalent preferred.
• Annual cybersecurity strategy/roadmap refresh; quarterly portfolio delivery and investment reporting against approved milestones.
• Improved security maturity and measurable performance across threat detection/response, critical vulnerability remediation, access controls, third-party risk, and incident preparedness.
• Documented annual HIPAA Security risk analysis and risk-based security remediation plans.
• 100% of incoming material IT compliance issues registered, assigned, prioritized, and tracked.
• Risk-ranked RAFT plans for material findings; monthly review of overdue actions with Compliance and IT leadership.
• Regulatory deadlines met or escalated in advance; evidence-based closure and documented authorized risk acceptance.