IT Manager - Information Technology & Information Security

Pacific Health Group; San Diego (CA); Hybrid; USD 79,000 - 83,000; Full time

Job summary

Pacific Health Group seeks a seasoned Manager of Information Technology & Information Security to own the organization’s technology systems, data security, and regulatory compliance. This role combines strategic leadership with hands-on execution in a HIPAA-regulated healthcare environment, reporting to the CEO.

You will define security controls, oversee IT infrastructure, incident response, and privacy protections, and partner with legal to manage BAAs and audits.

Qualifications

• Extensive leadership experience in IT/security within a regulated environment.
• Proven expertise in HIPAA Security/Privacy Rule compliance and PHI safeguards.
• Ability to design, implement, and enforce an organization-wide security program.

Responsibilities

• Own the Information Security Program across the organization.
• Lead HIPAA risk analyses and remediation plans; manage BAAs from a security/IT view.
• Oversee IT infrastructure, cloud, networks, endpoints, and SaaS applications for security and reliability.
• Establish incident response plans and manage security incidents, breaches, and investigations.
• Define data classification, encryption, access controls, logging, monitoring, and retention policies.

Skills

IT leadership

HIPAA compliance

Cybersecurity governance

Risk management

Vendor management

Cloud security

Incident response

Education

Bachelor's degree in IT/CS or related field

Tools

Cloud platforms (AWS/Azure)

Job description

Job Snapshot

Location: Hybrid – San Diego, CA (Frequent Local Travel Required)
Employment Type: Full-Time
Compensation: $78,500 – $82,500 annually (based on experience and qualifications)
Schedule: Full-Time

Reports To: Chief Executive Officer
Work Environment: Hybrid (In-person collaboration with travel throughout San Diego County)

Preferred Residence: Rancho Bernardo, Poway, Rancho Peñasquitos, or Scripps Ranch area.

About Pacific Health Group

At Pacific Health Group, we care deeply about the people and communities we serve. We meet individuals with kindness, respect, and understanding—listening first, honoring each person’s journey, and offering support without judgment.

Through compassionate, person-centered healthcare, behavioral health services, and social supports, we walk alongside people as they work toward healing, stability, and a healthier, more hopeful life.

Our Core Values

• Speak with integrity—clear, respectful, and honest in every interaction.
• Embrace innovation, trying new ideas, learning fast, and improving care.
• Own our roles, staying accountable for outcomes and documenting accurately.
• Build genuine connections with members, families, and teammates through empathy and cultural sensitivity.
• Lead with trust by being consistent, transparent, and following through.
• Celebrate wins together, recognizing individual and team achievements.
• Collaborate with purpose, partnering across departments and with community providers to solve problems.
• Ask for support and offer support, because thriving together is how we serve our members best

Role Overview & Impact

The Manager of Information Technology & Information Security is responsible for the end-to-end ownership of all technology systems, data security, and regulatory compliance at Pacific Health Group. This role establishes, governs, and enforces the organization’s security posture, ensuring that all systems, data, and operations meet or exceed HIPAA, HITECH, and industry best practices.

This position functions as the single point of accountability for IT infrastructure, cybersecurity, data protection, PHI safeguards, and security governance. The role requires both strategic leadership and hands‑on execution in a regulated healthcare environment. This position directly safeguards organizational integrity, regulatory standing, and operational continuity.

Core Responsibilities

Information Security Program Ownership

• Architect and maintain a formal, organization-wide Information Security Program.
• Define and enforce security controls across applications, infrastructure, devices, and users.
• Establish policies for data classification, encryption, access control, logging, monitoring, and retention.
• Implement least-privilege access and zero-trust principles across systems.
• Continuously monitor evolving threat landscapes and proactively adapt controls.

HIPAA, PHI & Regulatory Compliance

• Serve as the internal authority for HIPAA Security Rule and Privacy Rule compliance.
• Ensure proper safeguards for the creation, storage, transmission, and disposal of PHI.
• Maintain compliance documentation, risk assessments, and audit evidence.
• Lead HIPAA risk analyses and remediation plans.
• Oversee Business Associate Agreements (BAAs) from a security and IT standpoint.
• Coordinate and support internal and external audits, assessments, and investigations.
• Conduct regular testing of disaster recovery and business continuity plans.

IT Infrastructure & Systems Oversight

• Own the design, implementation, and maintenance of all IT systems, including cloud platforms, networks, endpoints, SaaS applications, and internal tools.
• Ensure systems are secure, resilient, and scalable.
• Implement and maintain backup and disaster recovery plans, business continuity procedures, and system redundancy strategies.
• Approve and govern all technology deployments and architectural changes.
• Oversee installation, configuration, and lifecycle management of hardware, software, and telecommunications systems.
• Ensure system reliability, uptime, and performance across all departments.

Cybersecurity Operations & Incident Response

• Establish formal incident response plans and escalation procedures.
• Lead response efforts for security incidents, attempted breaches, phishing, impersonation, or data exposure.
• Conduct root cause analysis and implement corrective actions.
• Ensure proper breach notification processes are followed when required by law.
• Maintain logs, alerts, and monitoring systems to detect suspicious activity.

Data Protection & Privacy

• Define and enforce controls for sensitive data, PHI, and confidential business information.
• Ensure encryption standards are applied to data at rest and in transit.
• Govern data access, sharing, and retention policies.
• Partner with legal and compliance stakeholders on privacy matters.
• Prevent unauthorized data access, leakage, or misuse.

Vendor, Tool & Third-Party Risk Management

• Evaluate the security posture of third-party vendors and platforms.
• Approve technology vendors based on security, compliance, and risk criteria.
• Monitor ongoing vendor compliance and contractual obligations.
• Ensure third-party access is controlled, monitored, and revoked as needed.

Governance, Training & Enforcement

• Develop and enforce IT and security policies applicable to all staff.
• Deliver security awareness training, including phishing and impersonation prevention.
• Ensure staff understand approved communication channels and security protocols.
• Investigate and address violations of IT or security policy.
• Establish clear escalation paths and disciplinary guidance related to security breaches.
• Supervise IT staff, providing direction, training, and performance evaluations.

Strategy, Reporting & Executive Advisory

• Define a long-term IT and security roadmap aligned with business growth.
• Provide regular reporting to executive leadership on security risks, compliance status, incidents, and improvement initiatives.
• Advise leadership on technology risk, investments, and operational trade-offs.
• Balance operational efficiency with regulatory and security requirements.

Success Measures

• Successful implementation and maintenance of a formal Information Security Program.
• 100% compliance with HIPAA Security Rule and related regulatory requirements.
• Reduced security incidents and rapid, compliant response to threats.
• Completion of risk assessments, audit readiness, and remediation initiatives.
• Secure, scalable IT infrastructure supporting organizational growth.

Required Qualifications

• Extensive experience in IT, cybersecurity, or information security leadership.
• Demonstrated expertise in HIPAA compliance and healthcare data protection.
• Strong understanding of cloud security, endpoint security, and identity management.
• Experience creating policies, controls, and compliance frameworks from the ground up.
• Ability to operate with high autonomy and accountability.

Preferred Qualifications

• CISSP, CISM, or equivalent security certifications.
• Prior experience in healthcare, health tech, or regulated industries.
• Experience managing audits, risk assessments, and compliance programs.
• Familiarity with NIST, ISO 27001, or similar security frameworks.

Authority & Accountability

• Authority to approve or deny technology tools, vendors, and system access.
• Responsible for enforcing security policy across all departments.
• Accountable for protecting company data, systems, and regulatory standing.

Time Off & Leave

• Paid Time Off
• Holidays
• Volunteer time
• Bereavement

Health & Wellness

• Medical coverage
• FSAs or other wellness benefits
• Disability and EAP

Financial & Professional

• 401(k)
• Stipends
• Professional development

Culture & Perks

• Employee discounts
• Team events
• Growth opportunities

Equal Opportunity Employer

Pacific Health Group is an Equal Opportunity Employer. We are committed to creating an inclusive and equitable workplace where all individuals are treated with dignity and respect. All qualified applicants will receive consideration for employment without regard to race, color, religion or creed, sex (including pregnancy, childbirth, breastfeeding, and related medical conditions), gender, gender identity or gender expression, sexual orientation, national origin or ancestry, citizenship status, physical or mental disability, medical condition (including cancer and genetic characteristics), age (40 and over), marital status, military or veteran status, genetic information, or status as a victim of domestic violence, assault, or stalking. We value diversity in all forms and encourage individuals from historically underrepresented communities to apply.