Information Security Manager

Avita Care Solutions; Plano (TX); On-site; USD 130,000 - 170,000; Full time

Benefits offered by this job

Healthcare benefits

Paid time off

401(k) retirement plan

Job summary

Avita Care Solutions is seeking an Information Security Manager to own day‑to‑day security program execution, governance and risk across Avita Care Solutions and Q Care Plus.

You will shape and advance an established vulnerability management program, coordinate with external providers and internal owners, and develop the security team through hands‑on coaching and shared ownership.

Qualifications

• Demonstrated success building and operating a security program with governance and risk management.
• Healthcare security experience is preferred; strong regulated‑industry candidates welcome.
• CISSP, CISM or a comparable certification is preferred; CRISC is a plus.
• Hands‑on judgment across infrastructure, endpoints, identity, networks and cloud.

Responsibilities

• Advance and enforce vulnerability management across MSP/MSSP transitions and providers.
• Lead operational incident response and coordination with providers and internal teams.
• Run GRC and third‑party risk management platforms and processes.
• Own ITSM workflows, integration requirements and end‑to‑end tests.
• Define roadmaps with executive leadership and coach the Information Security team.
• Conduct regular service reviews and verify remediation with evidence.

Skills

Security leadership

GRC

Vendor management

Incident response

ITSM workflows

Team coaching

Education

Relevant degree or equivalent experience

Job description

The Information Security Manager will help protect patient information and the systems that support care across Avita Care Solutions and Q Care Plus. Own day-to-day security program execution in support of the SVP, Enterprise Technology and enterprise goals. Combine hands‑on security operations, governance, risk and compliance (GRC), third‑party risk management (TPRM), provider oversight and team development. Advance the established Vulnerability Management Program (VMP) through a separate‑provider model, turning findings into policy‑governed assignments, verified outcomes and clear escalations.

Shape the next phase of an established security program, strengthen coordination across specialist providers, and develop the Information Security team through hands‑on coaching and shared ownership. Work alongside the Junior Information Security Engineer, providers and internal technical owners to turn program improvements into practical delivery.

What You You'll Do:

Advance and Enforce Vulnerability Management

• Advance the established VMP as Avita transitions from a legacy combined MSP/MSSP to separate Managed Service Provider (MSP), Managed Security Service Provider (MSSP), and Managed Network/Connectivity Providers.
• Apply Avita’s Vulnerability Management policies to prioritize findings, assign external‑provider and internal IT remediation owners, track policy timelines, validate evidence and closure, document exceptions and escalat.
• The MSSP identifies and monitors findings; the MSP, network/connectivity providers and internal technical owners implement, test and provide remediation evidence within their scope.
• Lead work requirements, hands‑on investigation, constructive challenge and validation of fixes in collaboration with those owners.
• Escalate unresolved internal‑team issues through the SVP, Enterprise Technology or CTO.

Manage Security Providers and Service Outcomes

• Own the day‑to‑day security‑service relationship with the MSSP and coordinate security responsibilities with the MSP and Managed Network/Connectivity Providers.
• Conduct regular service reviews, check monitoring and vulnerability coverage, test escalation paths and follow documented improvement actions to completion.
• Evaluate provider recommendations through constructive follow‑up questions, meaningful evidence and verification.
• Coordinate responsibilities across providers and internal teams, monitor service commitments and report measurable outcomes, unresolved gaps and decisions needed.

Own ITSM Workflows and Integration Requirements

• Own vendor workflow design and integration requirements in the organization’s IT service management (ITSM) platform.
• Ensure MSSP findings reach the correct provider or internal technical owner and return with visible status, remediation evidence, verification and escalation.
• Define handoffs, acceptance criteria and end‑to‑end tests.
• Partner with technical owners who build and test the connections, and validate end‑to‑end workflow outcomes.

Run GRC and Third‑Party Risk Management

• Manage day‑to‑day GRC and TPRM platforms and processes, including risk‑register upkeep, control evidence, vendor assessments, security documentation and remediation follow‑through.
• Partner with control owners and Compliance to support audits, security questionnaires and practical policy enforcement.
• Check that evidence demonstrates control operation and that gaps have owners and a path to resolution.
• Prepare clear, evidence‑based risk and exception recommendations for the appropriate decision‑makers.

Lead Operational Incident Response

• Lead operational response during significant security incidents: coordinate investigation, containment and recovery with technical owners and providers, maintain timely status and evidence, and drive post‑incident improvements.
• The SVP, Enterprise Technology retains executive escalation and business decisions.
• Partner with Compliance and Legal on privacy and legal determinations; HIPAA breach determinations, breach logs, regulatory reporting and notifications remain with Compliance and Legal as applicable.
• Coordinate response through the team and providers.

Execute the Roadmap with Clear Accountability

• Partner with the SVP, Enterprise Technology and CTO on evidence‑based roadmap and investment recommendations and escalated decisions, then translate approved plans into practical work and reporting.
• Lead the Information Security team and collaborate with peer directors and provider leaders through dotted‑line security oversight, with technical owners implementing approved changes under change control.
• The SVP, Enterprise Technology and CTO set strategy and priorities; authorized leadership approves budgets and contracts and accepts enterprise risk.

Leadership and Core Values

• Be a servant leader who strengthens the team through coaching, clear expectations and practical problem‑solving.
• Develop the Junior Information Security Engineer through hands‑on investigation, technical judgment, evidence review and increasing ownership.
• Remove obstacles, give constructive feedback and use providers effectively while remaining engaged with technical findings.
• Compassion: Listening to team members and partners, understanding the impact of security work on patient‑serving operations, and responding with respect while maintaining accountability.
• Resourcefulness: Investigating beyond the first answer, asking constructive provider questions, requesting evidence and testing assumptions to find workable solutions that protect patient information and support care.
• Collaboration: Agreeing on ownership and handoffs, sharing context openly, coaching colleagues and resolving provider or cross‑team gaps constructively so security work supports patient‑serving operations.

About You:

• A relevant degree or equivalent professional experience.
• Demonstrated success building and operating a security program, turning vulnerabilities and risk decisions into assigned work and verified outcomes.
• Healthcare security experience is preferred; strong regulated‑industry candidates are welcome.
• Prior Director‑level experience is preferred, but appropriate program, team and provider leadership may qualify.
• CISSP, CISM or a comparable certification is preferred, not required with adequate experience; CRISC is an additional advantage.
• Hands‑on judgment across infrastructure, endpoints, identity, networks and cloud to investigate findings, assess recommendations and validate remediation.
• Practical experience in incident response, GRC, control evidence, TPRM, and ITSM workflow design and testing.
• Effective team coaching, cross‑functional influence and external‑provider management, including service reviews and constructive escalation.
• Strong prioritization, problem‑solving and communication
• Able to lead program, team and provider execution while staying technically engaged
• Work hours 8am-5pm, Monday- Friday, with ability to be flexible

At Avita Care Solutions, compassionate care is at the heart of everything we do. Join Avita and get inspired to be the care that unlocks the full potential of health for all. We’re committed to promoting health equity by providing comprehensive, integrated access to pharmacy services, clinical care delivery and digital health through our individualized and culturally competent LGBTQ+, HIV, PrEP, and sexual wellness care. Avita is a proud member of the U.S. Business Action to End HIV and has been recognized multiple times by the Human Rights Campaign Foundation as a Best Place to Work for LGBTQ+ Equality.

Avita is an Equal Opportunity Employer dedicated to building a diverse, inclusive, and authentic workplace. We welcome everyone by recruiting, hiring, and promoting individuals without regard to their sex, race, color, age, national origin, religion, disability, genetic information, marital status, sexual orientation, gender identity, veteran status, or any other status protected by applicable law. Avita also provides reasonable accommodation for qualified individuals with disabilities in accordance with the Americans with Disabilities Act (ADA) and any other state or local laws.

Pay range: $130,000- $170,000 annual salary, based on credentials and geographic location.

Avita Care Solutions offers a comprehensive benefits package:

• Healthcare benefits (medical, dental, vision) for eligible team members and their families, along with additional company paid and voluntary benefit offerings.
• Six company paid holidays and three personal floating holidays, paid time off (PTO), paid leaves - two weeks paid parental leave, bereavement, sick leave, time to vote and jury duty, award recognition program, professional learning and development opportunities.
• Company paid benefits – basic life and AD&D, Maven and Health Care Advocate Work/Life Balance Program, health/dependent flexible spending.
• Voluntary benefits – long and short‑term disability, pet insurance, legal, accident, hospital indemnity, critical illness, whole and supplementary life insurance, identity theft protection, 401(K) retirement savings plan with company match.

All benefits are subject to the applicable plan terms.