What are the responsibilities and job description for the Director of IT Security and Audit position at Johns Hopkins Health Plans?
Job Responsibilities :
Reporting to the VP of IT & Chief Information Officer (CIO), the Director, IT Security and Audit (Chief Information Security Officer, or CISO) is the senior-most IT Security leader in the organization. This position is a key part of the IT leadership team, responsible for overseeing the IT Security and Audit function for the organization. The Director & CISO is responsible for ensuring the confidentiality, integrity, and availability of all information assets, and for implementing robust security measures to protect against cyber threats. The Director & CISO applies a deep understanding of the healthcare industry, regulatory requirements (including government-sponsored lines of business), and the evolving landscape of cybersecurity to the development, implementation, and maintenance of JHHP’s comprehensive information security strategy that is aligned with business goals and regulatory requirements.
Key responsibilities include :
- Lead and manage the information security team, providing strategic direction, mentorship, and support to ensure high performance and professional growth.
- Oversee the development and enforcement of security policies, procedures, and standards to protect sensitive information and maintain regulatory compliance (e.g., HIPAA, HITRUST, CMMC, NIST-800-171, SOC 2 Type 2, etc.).
- Conduct risk assessments and vulnerability analyses to identify potential security threats and develop mitigation plans.
- Lead modern security initiatives and technologies (Security Architecture
- Zero Trust Model
- Cloud Security Maturity Model
- Vulnerability Management Maturity Model
- Security Awareness Maturity Model
- Negotiation Strategies)
- Implement and manage security technologies and solutions, including firewalls, intrusion detection systems, encryption, and identity and access management systems.
- Grow IT Audit management function to ensure wider coverage.
- Implement strong vendor security oversight model for ongoing coverage.
- Monitor and respond to security incidents and breaches, conducting thorough investigations and implementing corrective actions.
- Collaborate with cross-functional teams, including IT, legal, compliance, and operations, to ensure a holistic approach to information security.
- Educate and train employees on security best practices and emerging threats to foster a culture of security awareness.
- Stay current with industry trends, emerging threats, and best practices in information security and healthcare regulations.
- Develop and maintain relationships with external partners, including law enforcement, regulatory bodies, and cybersecurity vendors.
- Report regularly to executive leadership and the board of directors on the status of the information security program and key initiatives. Chair the Cybersecurity Governance Committee.
- Collaborate with compliance and privacy organization to ensure consistent policies and enforcement.
- Collaborate with business leaders on the development and regular testing of the organization business continuity plan.
- Drive mock DR exercises to ensure organizational readiness.
Qualifications :
