Senior Information Security Officer – Government & Healthcare

Mass; Boston (MA); Hybrid; USD 103,000 - 159,000; Full time

Job summary

The Department of Mental Health is seeking an Information Security Officer to lead the agency's cybersecurity program, ensuring governance, risk oversight, and protection of ePHI across systems and cloud services. You will collaborate with legal, privacy, and IT leadership to align security with regulatory requirements and DMH mission needs.

Responsibilities include directing risk management, IAM oversight, incident response, and regulatory compliance, while communicating security posture to

Qualifications

• At least 6 years of professional, administrative, supervisory, or managerial experience.
• At least 2 years in a project management, supervisory, or managerial role.
• Experience with HIPAA Security Rule and protecting ePHI.
• Familiarity with NIST CSF, CIS Controls, and secure SDLC practices.
• Experience implementing identity and access management controls.
• Ability to translate cybersecurity risks for executive stakeholders.
• Knowledge of Commonwealth information security policies and standards.

Responsibilities

• Lead agency-wide information security program with governance frameworks.
• Identify, assess, and communicate security risks and mitigations.
• Oversee application, system, and data security for ePHI confidentiality and integrity.
• Oversee identity and access management controls and reviews.
• Coordinate incident response and vulnerability management activities.
• Advance business continuity and disaster recovery planning.
• Oversee third-party cybersecurity risk and regulatory compliance.
• Collaborate with leadership to integrate cybersecurity into decisions.
• Promote cybersecurity awareness and education across the agency.
• Provide executive risk assessments and security performance reports.

Skills

Information security governance

Cybersecurity risk management

HIPAA security

NIST CSF

Identity and access management

Cloud security

Incident response

Business continuity

Vendor risk management

Executive communication

Education

Bachelor's degree or higher in related field

Job description

The Department of Mental Health is seeking an Information Security Officer to lead the agency's cybersecurity program, ensuring governance, risk oversight, and protection of ePHI across systems and cloud services. You will collaborate with legal, privacy, and IT leadership to align security with regulatory requirements and DMH mission needs.

Responsibilities include directing risk management, IAM oversight, incident response, and regulatory compliance, while communicating security posture to