Director of Information Security

This is a fully remote position, open to applicants in Illinois, +3 more states.

📋 Description

• Take charge of the information security program, encompassing strategy, a multi-year roadmap, budget recommendations, and success metrics.

• Design, implement, and sustain security technologies in both on-premises and cloud settings.

• Execute and document the technical safeguards mandated by the HIPAA Security Rule for systems that handle ePHI.

• Align security controls with the NIST Cybersecurity Framework and NIST SP 800-53, identify deficiencies, and drive remediation efforts.

• Manage PCI DSS compliance for cardholder data environments, which includes segmentation, system hardening, ASV scans, assessments, and audit evidence collection.

• Conduct HIPAA security risk analysis and risk management, keeping a risk register and communicating decisions to leadership.

• Oversee vulnerability and patch management programs.

• Design and maintain identity and access management controls, including MFA, role-based access, privileged access management, and access reviews.

• Direct the incident response program, including plans, playbooks, tabletop exercises, and incident response initiatives.

• Coordinate breach risk assessments with compliance and legal teams.

• Prepare for and lead external audits, OCR inquiries, payer or partner security assessments, and customer security questionnaires.

• Manage third-party risk, including vendor and Business Associate reviews, as well as security terms in Business Associate Agreements.

• Contribute to security awareness initiatives and provide guidance to IT staff on secure practices.

• Carry out additional duties as assigned.

⛳️ Requirements

• A Bachelor’s degree in Computer Science, Management Information Systems, or a related field is preferred.

• At least three years of combined experience in information security, compliance, technology audit, or a related field.

• Proficient understanding of the HIPAA Security Rule, the NIST CSF and SP 800-53, and PCI DSS v4.0 requirements.

• Hands-on experience with SIEM (e.g., Splunk, Microsoft Sentinel), EDR (e.g., CrowdStrike, Defender), next-generation firewalls, and vulnerability scanners (e.g., Tenable, Qualys, Rapid7).

• A solid grasp of networking concepts (TCP/IP, segmentation, VPNs), Windows and Linux administration, and Active Directory/Entra ID.

• Experience in securing cloud environments (AWS, Azure, or GCP).

• Strong written communication abilities, including the capacity to create clear documentation for auditors and convey risk to non-technical stakeholders.

• Relevant certifications such as CISSP, CISM, GIAC (GSEC, GCIH, GCCC), CompTIA Security+/CASP+, HCISPP, or a cloud security certification are preferred.

• Familiarity with HITRUST CSF is preferred.

• Experience in scripting or automation (PowerShell, Python, Bash) and a basic understanding of infrastructure-as-code are preferred.

• Capability to set priorities and effectively complete multiple assignments.

• Ability to work efficiently both independently and as part of a team.

• Excellent verbal and written communication skills.

• Strong analytical abilities with a focus on detail and accuracy.

• Ability to organize complex work tasks for various clients and ensure timely, accurate service delivery.

• Capacity to work independently with minimal supervision.

• Occasional travel may be required.

🏝️ Benefits

• Medical

• Health Savings Account for High Deductible Medical plan

• Dental

• Vision

• Life Insurance

• Disability Insurance

• Retirement with Company Matching

• Paid Time Off & Holidays

• Employee Assistance Program

• Referral Program