Information Security Officer

Commonwealth of Massachusetts; Boston (MA); Hybrid; USD 103,000 - 159,000; Full time

Job summary

The Department of Mental Health is seeking an Information Security Officer to lead the agency's cybersecurity program, ensuring governance, risk oversight, and protection of ePHI across systems and cloud services. You will collaborate with legal, privacy, and IT leadership to align security with regulatory requirements and DMH mission needs.

Responsibilities include directing risk management, IAM oversight, incident response, and regulatory compliance, while communicating security posture to

Qualifications

• At least 6 years of professional, administrative, supervisory, or managerial experience.
• At least 2 years in a project management, supervisory, or managerial role.
• Experience with HIPAA Security Rule and protecting ePHI.
• Familiarity with NIST CSF, CIS Controls, and secure SDLC practices.
• Experience implementing identity and access management controls.
• Ability to translate cybersecurity risks for executive stakeholders.
• Knowledge of Commonwealth information security policies and standards.

Responsibilities

• Lead agency-wide information security program with governance frameworks.
• Identify, assess, and communicate security risks and mitigations.
• Oversee application, system, and data security for ePHI confidentiality and integrity.
• Oversee identity and access management controls and reviews.
• Coordinate incident response and vulnerability management activities.
• Advance business continuity and disaster recovery planning.
• Oversee third-party cybersecurity risk and regulatory compliance.
• Collaborate with leadership to integrate cybersecurity into decisions.
• Promote cybersecurity awareness and education across the agency.
• Provide executive risk assessments and security performance reports.

Skills

Information security governance

Cybersecurity risk management

HIPAA security

NIST CSF

Identity and access management

Cloud security

Incident response

Business continuity

Vendor risk management

Executive communication

Education

Bachelor's degree or higher in related field

Job description

An Official website of the Commonwealth of Massachusetts

Job Description - Information Security Officer (260007LY)

Job Description

Information Security Officer - ( 260007LY )

Description

The Massachusetts Department of Mental Health (DMH) is looking for an Information Security Officerto join its team.The Information Security Officer (ISO) is the Department of Mental Health's senior agency-level official responsible for leading and coordinating the information security program and for ensuring that cybersecurity risks affecting DMH information, applications, technology-enabled services, and electronic protected health information (ePHI) are identified, assessed, communicated, and treated in a manner consistent with DMH mission needs, legal and regulatory obligations, Commonwealth requirements, and accepted risk-management practices.

The Information Security Officer provides independent security governance and risk oversight while working closely with DMH business and application owners, the Privacy and Data Access Officer, Compliance, General Counsel, Quality, facility leadership, EOHHS IT/Secretariat technology leadership, and EOTSS Cybersecurity and Enterprise Risk Management/Security Operations. The role is accountable for the effectiveness of the agency security management program; it is not expected to personally operate every technical security control that may be provided by EOHHS, EOTSS, application teams, infrastructure teams, vendors, or managed service providers.

Duties and Responsibilities (these duties are a general summary and not all inclusive):

• · Lead and oversee the Department of Mental Health’s (DMH) agency-wide information security program, developing cybersecurity strategies, policies, procedures, and governance frameworks aligned with organizational priorities, regulatory requirements, and Commonwealth security standards.
• · Direct enterprise cybersecurity risk management efforts by identifying, assessing, prioritizing, and communicating security vulnerabilities, compliance gaps, and emerging threats while recommending mitigation strategies and monitoring corrective actions.
• · Provide strategic oversight of application, system, and data security to ensure the confidentiality, integrity, and availability of sensitive information, including electronic protected health information (ePHI), across technology platforms, cloud services, and data-sharing environments.
• · Strengthen identity and access management practices by overseeing authentication protocols, access controls, privileged account management, and periodic security reviews to ensure appropriate authorization and protection of confidential information.
• · Coordinate cybersecurity incident response and vulnerability management activities in collaboration with internal stakeholders, Commonwealth technology partners, and external service providers to support timely threat detection, incident resolution, and continuous security improvements.
• · Advance business continuity, disaster recovery, and organizational resilience initiatives by evaluating critical technology dependencies, strengthening recovery strategies, and supporting preparedness efforts that minimize operational disruptions to essential behavioral health services.
• · Oversee third-party cybersecurity risk and regulatory compliance by evaluating vendor security practices, establishing security requirements, and supporting audits, assessments, and accreditation activities in accordance with HIPAA, Commonwealth policies, and recognized industry standards.
• · Collaborate with executive leadership, legal counsel, privacy officers, technology teams, and operational stakeholders to integrate cybersecurity considerations into organizational decision-making, technology modernization, procurement, and strategic initiatives.
• · Promote a culture of cybersecurity awareness and accountability by providing expert guidance, supporting security education initiatives, and communicating emerging risks, security expectations, and best practices across the agency.
• · Serve as a trusted cybersecurity advisor to senior leadership, delivering executive-level risk assessments, security performance reports, and strategic recommendations while exercising independent judgment to strengthen security governance, regulatory readiness, and the protection of DMH's critical information assets.

Preferred Qualifications:

• · Extensive knowledge of information security governance, cybersecurity risk management, and enterprise security frameworks, including experience developing security policies, conducting risk assessments, evaluating internal controls, and implementing effective remediation strategies.
• · Demonstrated knowledge of healthcare information security regulations, including the Health Insurance Portability and Accountability Act (HIPAA) Security Rule and requirements for safeguarding electronic protected health information (ePHI) and other confidential data.
• · Strong understanding of recognized cybersecurity frameworks and industry best practices, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, NIST risk management principles, CIS Controls, and secure system development practices.
• · Experience implementing and evaluating identity and access management controls, including role-based access, multi-factor authentication, privileged access management, user authorization, and periodic access reviews.
• · Comprehensive knowledge of cybersecurity technologies and security operations, including cloud security, network protection, encryption, vulnerability management, security monitoring, incident response, and threat mitigation.
• · Demonstrated experience assessing security risks associated with enterprise applications, cloud-based platforms, third-party vendors, and data-sharing environments, with the ability to recommend practical solutions that support organizational and operational objectives.
• · Experience supporting business continuity, disaster recovery, and cybersecurity incident response planning, including evaluating critical system dependencies, coordinating recovery activities, and strengthening organizational resilience.
• · Familiarity with Commonwealth of Massachusetts information security policies, standards, and procedures, including those established by the Executive Office of Technology Services and Security (EOTSS), or the demonstrated ability to acquire this knowledge quickly.
• · Excellent analytical, written, verbal communication, and interpersonal skills, with demonstrated ability to translate complex cybersecurity risks into actionable recommendations, advise executive leadership, and collaborate effectively with technical and nontechnical stakeholders.
• · Proven leadership, strategic planning, and organizational management abilities, including experience managing competing priorities, establishing security performance measures, influencing cross-functional teams, and exercising independent judgment within a complex healthcare, government, or similarly regulated environment.

Department of Mental Health’s Mission:

The Department of Mental Health assures and provides access to services and support to meet the mental health needs of individuals of all ages, enabling them to live, work and participate in their communities. The Department establishes standards to ensure effective and culturally competent care to promote recovery. The Department sets policy, promotes self-determination, protects human rights and supports mental health training and research.

Pre-Offer Process:

A tax & background check will be completed on the recommended candidate as required by the regulations set forth by the Human Resources Division prior to the candidate being hired.

Education, licensure and certifications will be verified in accordance with the Human Resources Division's Hiring Guidelines.

Education and license/certification information provided by the selected candidate(s) is subject to the Massachusetts Public Record Law and may be published on the Commonwealth's website.

For questions regarding this requisition, please contact the Executive Office of Health and Human Services Human Resources at 1-800- 510-4122 Ext. #4

Qualifications

MINIMUM ENTRANCE REQUIREMENTS:

Applicants must have at least (A) six (6) years of full-time or, equivalent part-time, professional, administrative, supervisory, or managerial experience in business administration, business management, public administration, public management, clinical administration or clinical management of which (B) at least two (2) years must have been in a project management, supervisory or managerial capacity or (C) any equivalent combination of the required experience and substitutions below.

Substitutions:

I. A certificate in a relevant or related field may be substituted for one (1) year of the required (A) experience.

II. A Bachelor's degree in a related field may be substituted for two (2) years of the required (A) experience.

III. A Graduate degree in a related field may be substituted for three (3) years of the required (A) experience.

IV. A Doctorate degree in a related field may be substituted for four (4) years of the required (A) experience.

Salary placement is determined by a combination of factors, including the candidate’s years of directly related experience and education, and alignment with our internal compensation structure as set forth by the Human Resources Division’s Hiring Guidelines. For all bargaining unit positions (non-management), compensation is subject to the salary provisions outlined in the applicable collective bargaining agreement and will apply to placement within the appropriate salary range.

When you embark on a career with the Commonwealth, you are offered an outstanding suite of employee benefits that add to the overall value of your compensation package. We take pride in providing a work experience that supports you, your loved ones, and your future.

Title 101 CMR 23.00 (“Regulation”) requires certain agency staff to have received the COVID-19 vaccination and Influenza vaccination, or have taken required mitigation measures, to prevent viral infection and transmission in State Hospitals and State Congregate Care Facilities. The Regulation applies to this position. Successful candidates will be required to acknowledge and attest to your vaccination status for both COVID-19 and Influenza.

An Equal Opportunity / Affir

The Commonwealth is an Equal Opportunity Employer and does not discriminate on the basis of race, religion, color, sex, gender identity or expression, sexual orientation, age, disability, national origin, veteran status, or any other basis covered by appropriate law. Research suggests that qualified women, Black, Indigenous, and Persons of Color (BIPOC)may self-select out of opportunities if they don't meet 100% of the job requirements. We encourage individuals who believe they have the skills necessary to thrive to apply for this role.

Job

Information Systems and Technology

Agency

Department of Mental Health

Schedule

Full-time

Shift

Day

Number of Openings

1

Salary

102,855.80 - 158,640.55 Yearly

If you have Diversity, Affir

Bargaining Unit : M99-Managers (EXE)

Confidential : No

Potentially Eligible for a Hybrid Work Schedule : Yes