Executive Director IT Security & CISO

Who We AreJPS Health Network is a $950 million, tax-supported healthcare system in North Texas. Licensed for 582 beds, the network features over 25 locations across Tarrant County, with John Peter Smith Hospital a Level I Trauma Center, Tarrant County's only psychiatric emergency center, and the largest hospital-based family medical residency program in the nation. The health network employs more than 7,200 people.

Acclaim Multispecialty Group is the medical practice group featuring over 300 providers serving JPS Health Network. Specialties range from primary care to general surgery and trauma. The Acclaim Multispecialty Group formed around a common set of incentives and expectations supporting the operational, financial, and clinical performance outcomes of the network. Our goal is to provide high quality, compassionate clinical care for every patient, every time.

Why JPS?We're more than a hospital. We're 7,200 of the most dedicated people you could ever meet. Our goal is to make sure the people of our community get the care they need and deserve. As community stewards, we abide by three Rules of the Road:

1. Own it.Everyone who wears the JPS badge contributes to our journey to excellence. 2. Seek joy.Every day, every shift, we celebrate our patients, smile, and emphasize positivity.

1. Don't be a jerk.Everyone is treated with courtesy and respect.  Smiling, laughter, compassion - key components of our everyday experience at JPS.

When working here, you're surrounded by passion, diversity, and dedication. We look forward to meeting you!

To view all job vacancies,

• Bachelor's Degree in Cybersecurity, Information Systems, Computer Science, Business Administration, Health Informatics, or related field of study from an accredited college or university.
• 10 plus years of information security experience; to include experience protecting complex clinical, business, and infrastructure environments in a healthcare setting, operating within a county, public, academic, safety net, or federally qualified health center environment, and experience building or maturing a security program with full budget accountability.
• 5 plus years of progressive leadership experience working in an information security role within a healthcare provider, health system, academic medical center, or similarly regulated environment; to include experience leading enterprise incident response for a material cybersecurity event.
• One of the following certifications: Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM) required.

• Master's Degree in Cybersecurity, Information Systems, Computer Science, Business Administration, Health Informatics, or related field of study from an accredited college or university.
• Healthcare Information Security and Privacy Practitioner (HCISPP).
• Certified in Risk and Information Systems Control (CRISC).
• Experience with a greenfield or major capital facility technology security build.
• Experience leading a Zero Trust program from strategy through operational execution.
• Experience securing a connected medical device and Internet of Medical Things environment at scale.
• Experience presenting cybersecurity risk to a Board of Directors or Board-level risk committee.
• Active membership or leadership role in the Health Information Sharing and Analysis Center (H-ISAC).

Location Address: 1350 S. Main Street Fort Worth, Texas, 76104 United States

Salaried

Executive Director IT Security & CISO

45967

Full Time

IT TECHNICAL SERVICES & SECURITY

Director / Management Level

JPOC 1350

Shift Worked: Job Description: Job Summary: The Executive Director IT Security & CISO provides strategic leadership for the organization's enterprise information security and cyber resilience program. Reporting to the SVP Chief Information Officer, this role serves as the HIPAA Security Official and is accountable for cybersecurity strategy, governance, architecture, operations, identity and access management, data protection, incident response, regulatory compliance, and third-party risk management. The Exec Dir IT Security & CISO leads the security organization, partners across clinical and business functions, and advises executive leadership and the Board on cybersecurity risk and resilience.

Essential Job Functions & Accountabilities:

1. Develops and executes the enterprise information security strategy and multi-year roadmap, defines the enterprise cybersecurity risk appetite in coordination with executive leadership and the Board, and ensures alignment with clinical, operational, and financial priorities.

1. Establishes and maintains the information security governance framework covering policies, standards, procedures, exceptions, and control ownership, and directs alignment with the NIST Cybersecurity Framework, NIST 800-53, and HITRUST.

1. Serves as the designated HIPAA Security Official with overall final responsibility for the security of electronic protected health information.

1. Reports information security posture, risk, and program performance to the CEO, SVP Chief Information Officer, executive leadership, and the Board, and leads ongoing cybersecurity education to strengthen executive and Board risk literacy.

1. Partners with the IT Security Risk Manager in the Office of Legal Affairs as the independent second-line risk oversight function, receives independent risk review findings, and drives remediation to closure.

1. Directs security architecture across cloud, on-premises, hybrid, and as-a-service environments and owns the Zero Trust roadmap across identity, network, workload, endpoint, and device domains.

1. Directs the enterprise Identity and Access Management program through the IAM Manager, including role-based access, access certification, multi-factor authentication, single sign-on, and Privileged Access Management.

1. Directs security operations, security engineering, endpoint protection, vulnerability management, patch management, threat detection, and coordination with Managed Security Service Providers through the Security Manager.

1. Directs enterprise data protection strategy covering classification, encryption, key management, Data Loss Prevention, backup and recovery security controls, and controls for inter-organization, intra-organization, and extra-organization clinical data movement.

1. Directs the insider threat program and partners with the Office of Legal Affairs, Compliance, and Research on data governance for secondary data use, analytics, and artificial intelligence model training.

1. Owns the enterprise cybersecurity incident response program including plan development, playbook maintenance, tabletop and functional exercises, and leads the technical response to active incidents in partnership with the Office of Legal Affairs, which owns HIPAA breach notification to the Office for Civil Rights and affected individuals.

1. Partners with Clinical Operations and IT Infrastructure to validate downtime procedures, disaster recovery readiness, and cyber-related business continuity plans so that patient care continues during technology disruptions and informs Due Care standards for the cyber insurance program managed by the Office of Legal Affairs.

1. Job description is not an all-inclusive list of duties and may be subject to change with or without notice. Staff are expected to perform other duties as assigned.