Program Manager, Cyber Risk

Meritus Health Inc; Winchester (VA); On-site; USD 135,476,000 - 211,868,000; Full time

Benefits offered by this job

Health plan

Dental and vision insurance

Generous PTO

Tuition assistance

Retirement match

Employee assistance program

Wellness program

Job summary

Valley Health is seeking a Cyber Risk Program Manager to strengthen the organization’s information security posture. This role supports RMF alignment and works with IT teams to identify and mitigate cyber risks on campus in Winchester.

The position requires 7+ years in IT and 5+ years in cybersecurity/risk management with knowledge of HIPAA, NIST, ISO 27000 and COBIT frameworks. Onsite presence 2–3 days/week at Winchester Medical Center.

Qualifications

• Bachelor’s or postgraduate degree in a related field is required.
• 5+ years in cybersecurity, risk management, IT audit, or compliance.
• Industry certifications expected within 1 year of hire.

Responsibilities

• Monitor security posture and provide risk-based recommendations.
• Lead vulnerability management across apps, OS, networks, cloud.
• Collaborate to remediate vulnerabilities and protect data assets.
• Oversee IT audit processes and HIPAA/NIST compliance documentation.
• Advise on policies to address evolving threats and regulations.
• Backup to Information Security Manager and support senior decisions.

Skills

Cybersecurity

Risk assessment

Communication

Regulatory compliance

Security governance

Education

Bachelor’s or postgraduate degree

Tools

GRC tools

Process automation

Security metrics

Policy management

Job description

As one of the nation's Top 15 Health Systems, recognized by Premier and Modern Healthcare, Valley Health is a place where excellence, compassion, and purpose come together. This distinction reflects our commitment to exceptional patient care, clinical quality, and the caregivers who make it all possible.

Department: INFORMATION SYSTEMS - 108231

Worker Sub Type: Regular

Work Shift: First Shift (United States of America)

Pay Range

$47.28 - $73.94

Job Description

Onsite work requirements 2-3 days a week at Winchester Medical Center campus.

The Cyber Risk Program Manager plays a key role in supporting the organization’s information security efforts. This position helps identify and assess potential security risks, working closely with teams to ensure alignment with security policies and the Risk Management Framework (RMF).

Responsibilities and Duties

• Monitors the security posture of systems, offering risk-based recommendations, and assisting with reviews and authorizations to operate.
• Leads the vulnerability management program, applying knowledge of applications, operating systems, networks, cloud infrastructure, and cyber threat tactics.
• Collaborates with internal teams to remediate vulnerabilities and implement strategies that protect company assets and data.
• Oversees the IT audit processes, providing documentation to prove compliance with HIPAA Security Regulations, NIST guidelines, and other governmental regulations. This includes ensuring adherence to organizational security policies and procedures.
• Makes recommendations on security policies as needed to ensure they are current and effective in addressing emerging threats and regulatory requirements.
• Serve as backup to the Manager of Information Security, handling escalations and participating in decision-making when higher-level guidance is required. This collaborative support ensures continuity in addressing complex security matters and facilitates informed, timely resolutions across the organization.

Education

Bachelor’s or postgraduate Degree in Business, Computer Science, Information Security or a related field is required.

Experience

• 7+ years of experience in information technology is required.
• 5+ years of work experience in cybersecurity, and/or 5+ years of experience in a risk management and/or IT audit role and/or 5+ years of experience with regulatory compliance and information security management frameworks (e.g., HIPAA Security Regulations, Health Information Technology for Economic and Clinical Health Act [HITECH Act], International Organization for Standardization [ISO] 27000, COBIT, National Institute of Standards and Technology [NIST] 800 RMF), is required.

Certifications & Licensures

• Industry advanced level cybersecurity certification required within 1 year of hire.

Qualifications

• Working knowledge of hospitals and healthcare industry required.
• Ability to communicate complex technical concepts to both technical and non-technical audiences, and collaborate effectively with IT teams and stakeholders.
• Understanding risk assessment methodologies to identify, evaluate, and prioritize cyber risks based on likelihood and impact.
• Understanding the vulnerability management lifecycle to identify, assess, prioritize and remediate vulnerabilities before they can be exploited.
• Understanding of relevant healthcare regulations and data privacy laws that impact cybersecurity practices.
• Strong understanding of cyber risk management frameworks (NIST, ISO 27001, etc.).
• Experience with GRC tools, process automation, security metrics and policy management.
• Commitment to staying current with the latest cybersecurity trends, threats, and technologies. Participation in ongoing training and certification programs.
• A strong technical foundation in information security, along with an understanding of business and governance processes, is essential.

Benefits

At Valley Health, we believe everyone is a caregiver, and our goal is to create an environment where our caregivers thrive physically, financially, and emotionally. In addition to a competitive salary, our most popular benefits for full-time employees include:

• A Zero-Deductible Health Plan
• Dental and vision insurance
• Generous Paid Time Off
• Tuition Assistance
• Retirement Savings Match
• A Robust Employee Assistance Program to help with many aspects of emotional wellbeing
• Membership to Healthy U: An Incentive-Based Wellness Program

Valley Health also offers a health savings account & flexible spending account for childcare, life insurance, short-term and long-term disability, and professional development. In addition, several perks come with working for the largest employer in the region, such as discounts to on-campus dining, and more.

To see the full scale of what we offer, visit valleyhealthbenefits.com.