Director, Information Security Engineering
Rochester Regional Health

Job Info

---

Description

SUMMARY

The Director is a key leadership role at Rochester Regional Health and has operational responsibility for the Security Engineering. The role is responsible for strategy & architecture, information security engineering, identity and access management engineering, and identity and access management administration. The Director's scope of responsibility is system-wide and spans across the Rochester Regional Health enterprise and covers all security engineering, identity and access engineering, and identity and access administration impacting the organization including enterprise and third/fourth party threats.

STATUS: Full Time

LOCATION: Riedman Campus

DEPARTMENT: Information Security

ATTRIBUTES

• Bachelor's Degree in IT, Engineering, Management or applicable discipline. Masters Degree Preferred.
• 3 years of experience in the cybersecurity field, preferably security engineering or identity & access management focused.
• Ability to collect and analyze facts from multiple sources and quickly develop and communicate hypotheses and recommendations to multiple stakeholders to facilitate rapid decision making and reach consensus.
• Knowledge of global standards related to cybersecurity and privacy: FDA Pre-Market and Post Market Guidance of Cybersecurity in Medical Devices, NIST Cybersecurity Framework 800-53 rev 4, ISO 270XX, ISO 62443, HIPAA/HITRUST, PCI DSS, and EU Standards - GDPR, NISD, Common Criteria, etc.

RESPONSIBILITIES

• Talent Management: Effectively recruits and retains talent for continuous support of the aligned system service line business areas. Fosters a team-based environment that collaborates across multiple disciplines to focus on continuous improvement and engagement. Monitors and recognizes performance of team members and supports people in professional development. Engages with team members to answer day to day operational questions and guidance.
• Strategy and Architecture: Develops a long term strategy and architecture for information security solutions (process and technical controls) based on information security standards, best practices and leading vendors and solutions. Makes ongoing well-researched security enhancement suggestions to management based on evolving trends. Remain abreast of industry trends to develop new defensive techniques addressing changes in adversary techniques and tactics. Troubleshoot and resolve issues involving identity and access management solutions.
• Collaborates all IT in the selection, implementation and management of efficient, effective and interoperable information security solutions. Participates in the change management process to ensure new IT solutions meet security requirements and inform the rest of IT of changes to information security solutions.
• Support the Vulnerability Management Team by implementing compensating controls to manage risks associated with vulnerabilities which cannot be remediated.
• Support Security Operations Center Team by leveraging information security controls to contain and eradicate information security threats. Execute daily administrative tasks, reporting, and communication with the relevant departments in the organization.
• Source and manage vendors of identity and access management technologies.
• Information Security Engineering: Architects, plan, implement, document, manage, monitor, and upgrade information security solutions (process and technical controls) for the protection of the organization's data, ioT, applications, systems, and networks to defend against hacking, malware and ransomware, insider threats and all types of cybercrime and nation-state threats. Researches, tests, and document optimal configurations of information security technologies.
• Identity & Access Management: Architects, plans, implements, documents, manages, monitors, and upgrades identity and access management solutions and systems including but not limited to identity governance and administration, access management and privileged access management. Research, test and document optimal configurations of identity and access management technologies.

EDUCATION:

• BS (Required)

PHYSICAL REQUIREMENTS: L - Light Work - Exerting up to 20 pounds of force occasionally, and/or up to 10 pounds of force frequently, and/or a negligible amount of force constantly; requires occasional walking, standing or squatting.

PAY RANGE: $140,000.00 - $170,000.00

The listed base pay range is a good faith representation of current potential base pay for successful applicants. It may be modified in the future. Pay is determined by factors including experience, relevant qualifications, specialty, internal equity, location, and contracts.

Rochester Regional Health is an Equal Opportunity / Affirmative Action Employer. Minority/Female/Disability/Veteran

---