Information Security Officer

Mass; Boston (MA); Hybrid; USD 103,000 - 159,000; Full time

Job summary

The Commonwealth of Massachusetts, Department of Mental Health, is seeking an Information Security Officer to lead the agency's information security program and oversee HIPAA and ePHI protections. You will coordinate risk management, incident response, and governance to safeguard critical data and services.

As a senior official, you will collaborate with executive leadership, legal, and IT partners to implement security controls, ensure regulatory readiness, and drive continuous security

Qualifications

• At least six years of professional security/leadership experience.
• Experience with HIPAA Security Rule and protecting ePHI.
• Knowledge of NIST CSF, CIS Controls, and secure SDLC practices.

Responsibilities

• Lead agency-wide information security program and governance.
• Identify, assess, and communicate vulnerabilities and risks.
• Oversee application, system, and data security for confidentiality, integrity, and availability.

Skills

Governance

Risk management

Policy development

Strategic communication

Leadership

Security awareness

Executive reporting

Education

Bachelor's degree in related field

Graduate degree in related field

Doctorate degree in related field

Tools

IAM & access controls

Vulnerability management

Cloud security

Encryption & data protection

Security monitoring

Job description

An Official website of the Commonwealth of Massachusetts

Job Description - Information Security Officer (260007LY)

Job Description

Information Security Officer - ( 260007LY )

Description

The Massachusetts Department of Mental Health (DMH) is looking for an Information Security Officerto join its team.The Information Security Officer (ISO) is the Department of Mental Health's senior agency-level official responsible for leading and coordinating the information security program and for ensuring that cybersecurity risks affecting DMH information, applications, technology-enabled services, and electronic protected health information (ePHI) are identified, assessed, communicated, and treated in a manner consistent with DMH mission needs, legal and regulatory obligations, Commonwealth requirements, and accepted risk-management practices.

The Information Security Officer provides independent security governance and risk oversight while working closely with DMH business and application owners, the Privacy and Data Access Officer, Compliance, General Counsel, Quality, facility leadership, EOHHS IT/Secretariat technology leadership, and EOTSS Cybersecurity and Enterprise Risk Management/Security Operations. The role is accountable for the effectiveness of the agency security management program; it is not expected to personally operate every technical security control that may be provided by EOHHS, EOTSS, application teams, infrastructure teams, vendors, or managed service providers.

Duties and Responsibilities (these duties are a general summary and not all inclusive):

• · Lead and oversee the Department of Mental Health’s (DMH) agency-wide information security program, developing cybersecurity strategies, policies, procedures, and governance frameworks aligned with organizational priorities, regulatory requirements, and Commonwealth security standards.
• · Direct enterprise cybersecurity risk management efforts by identifying, assessing, prioritizing, and communicating security vulnerabilities, compliance gaps, and emerging threats while recommending mitigation strategies and monitoring corrective actions.
• · Provide strategic oversight of application, system, and data security to ensure the confidentiality, integrity, and availability of sensitive information, including electronic protected health information (ePHI), across technology platforms, cloud services, and data-sharing environments.
• · Strengthen identity and access management practices by overseeing authentication protocols, access controls, privileged account management, and periodic security reviews to ensure appropriate authorization and protection of confidential information.
• · Coordinate cybersecurity incident response and vulnerability management activities in collaboration with internal stakeholders, Commonwealth technology partners, and external service providers to support timely threat detection, incident resolution, and continuous security improvements.
• · Advance business continuity, disaster recovery, and organizational resilience initiatives by evaluating critical technology dependencies, strengthening recovery strategies, and supporting preparedness efforts that minimize operational disruptions to essential behavioral health services.
• · Oversee third-party cybersecurity risk and regulatory compliance by evaluating vendor security practices, establishing security requirements, and supporting audits, assessments, and accreditation activities in accordance with HIPAA, Commonwealth policies, and recognized industry standards.
• · Collaborate with executive leadership, legal counsel, privacy officers, technology teams, and operational stakeholders to integrate cybersecurity considerations into organizational decision-making, technology modernization, procurement, and strategic initiatives.
• · Promote a culture of cybersecurity awareness and accountability by providing expert guidance, supporting security education initiatives, and communicating emerging risks, security expectations, and best practices across the agency.
• · Serve as a trusted cybersecurity advisor to senior leadership, delivering executive-level risk assessments, security performance reports, and strategic recommendations while exercising independent judgment to strengthen security governance, regulatory readiness, and the protection of DMH's critical information assets.

Preferred Qualifications:

• · Extensive knowledge of information security governance, cybersecurity risk management, and enterprise security frameworks, including experience developing security policies, conducting risk assessments, evaluating internal controls, and implementing effective remediation strategies.
• · Demonstrated knowledge of healthcare information security regulations, including the Health Insurance Portability and Accountability Act (HIPAA) Security Rule and requirements for safeguarding electronic protected health information (ePHI) and other confidential data.
• · Strong understanding of recognized cybersecurity frameworks and industry best practices, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, NIST risk management principles, CIS Controls, and secure system development practices.
• · Experience implementing and evaluating identity and access management controls, including role-based access, multi-factor authentication, privileged access management, user authorization, and periodic access reviews.
• · Comprehensive knowledge of cybersecurity technologies and security operations, including cloud security, network protection, encryption, vulnerability management, security monitoring, incident response, and threat mitigation.
• · Demonstrated experience assessing security risks associated with enterprise applications, cloud-based platforms, third-party vendors, and data-sharing environments, with the ability to recommend practical solutions that support organizational and operational objectives.
• · Experience supporting business continuity, disaster recovery, and cybersecurity incident response planning, including evaluating critical system dependencies, coordinating recovery activities, and strengthening organizational resilience.
• · Familiarity with Commonwealth of Massachusetts information security policies, standards, and procedures, including those established by the Executive Office of Technology Services and Security (EOTSS), or the demonstrated ability to acquire this knowledge quickly.
• · Excellent analytical, written, verbal communication, and interpersonal skills, with demonstrated ability to translate complex cybersecurity risks into actionable recommendations, advise executive leadership, and collaborate effectively with technical and nontechnical stakeholders.
• · Proven leadership, strategic planning, and organizational management abilities, including experience managing competing priorities, establishing security performance measures, influencing cross-functional teams, and exercising independent judgment within a complex healthcare, government, or similarly regulated environment.

Department of Mental Health’s Mission:

The Department of Mental Health assures and provides access to services and support to meet the mental health needs of individuals of all ages, enabling them to live, work and participate in their communities. The Department establishes standards to ensure effective and culturally competent care to promote recovery. The Department sets policy, promotes self-determination, protects human rights and supports mental health training and research.

Pre-Offer Process:

A tax & background check will be completed on the recommended candidate as required by the regulations set forth by the Human Resources Division prior to the candidate being hired.

Education, licensure and certifications will be verified in accordance with the Human Resources Division's Hiring Guidelines.

Education and license/certification information provided by the selected candidate(s) is subject to the Massachusetts Public Record Law and may be published on the Commonwealth's website.

For questions regarding this requisition, please contact the Executive Office of Health and Human Services Human Resources at 1-800- 510-4122 Ext. #4

Qualifications

MINIMUM ENTRANCE REQUIREMENTS:

Applicants must have at least (A) six (6) years of full-time or, equivalent part-time, professional, administrative, supervisory, or managerial experience in business administration, business management, public administration, public management, clinical administration or clinical management of which (B) at least two (2) years must have been in a project management, supervisory or managerial capacity or (C) any equivalent combination of the required experience and substitutions below.

Substitutions:

I. A certificate in a relevant or related field may be substituted for one (1) year of the required (A) experience.

II. A Bachelor's degree in a related field may be substituted for two (2) years of the required (A) experience.

III. A Graduate degree in a related field may be substituted for three (3) years of the required (A) experience.

IV. A Doctorate degree in a related field may be substituted for four (4) years of the required (A) experience.

Salary placement is determined by a combination of factors, including the candidate’s years of directly related experience and education, and alignment with our internal compensation structure as set forth by the Human Resources Division’s Hiring Guidelines. For all bargaining unit positions (non-management), compensation is subject to the salary provisions outlined in the applicable collective bargaining agreement and will apply to placement within the appropriate salary range.

When you embark on a career with the Commonwealth, you are offered an outstanding suite of employee benefits that add to the overall value of your compensation package. We take pride in providing a work experience that supports you, your loved ones, and your future.

Title 101 CMR 23.00 (“Regulation”) requires certain agency staff to have received the COVID-19 vaccination and Influenza vaccination, or have taken required mitigation measures, to prevent viral infection and transmission in State Hospitals and State Congregate Care Facilities. The Regulation applies to this position. Successful candidates will be required to acknowledge and attest to your vaccination status for both COVID-19 and Influenza.

An Equal Opportunity / Affir

The Commonwealth is an Equal Opportunity Employer and does not discriminate on the basis of race, religion, color, sex, gender identity or expression, sexual orientation, age, disability, national origin, veteran status, or any other basis covered by appropriate law. Research suggests that qualified women, Black, Indigenous, and Persons of Color (BIPOC)may self-select out of opportunities if they don't meet 100% of the job requirements. We encourage individuals who believe they have the skills necessary to thrive to apply for this role.

Job

Information Systems and Technology

Agency

Department of Mental Health

Schedule

Full-time

Shift

Day

Number of Openings

1

Salary

102,855.80 - 158,640.55 Yearly

If you have Diversity, Affir

Bargaining Unit : M99-Managers (EXE)

Confidential : No

Potentially Eligible for a Hybrid Work Schedule : Yes