VP, Chief Information Security Officer

When you join the growing BILH team, you're not just taking a job, you’re making a difference in people’s lives.

Job Description:

This leadership role directs, develops, and manages the Cyber Security function for the organization, including enterprise strategy, governance, architecture, operations, risk management, compliance, incident response, resilience, vendor risk, and workforce awareness. The role is accountable for protecting clinical, business, research, and administrative systems and information while supporting safe and reliable patient care.

This role defines and drives execution of enterprise cyber security policies, standards, investments, and performance measures across on-premises, cloud, digital health, EHR, ERP, data and analytics, connected medical device, and artificial intelligence environments. The role establishes security and risk requirements for AI technologies and prepares the organization for AI-enabled threats, including deepfake social engineering, automated phishing, prompt injection, data leakage, model manipulation, and unauthorized use of generative AI.

The role drives the use of AI in combating security threats.

As a member of the IT senior leadership team, the role contributes to enterprise IT and business strategy, advises executive leadership and appropriate board committees on material cyber risk, and partners with Privacy, Compliance, Legal, Risk, Internal Audit, Clinical Operations, Clinical Engineering, Data and Analytics, Human Resources, Supply Chain, and other leaders to strengthen enterprise resilience.

Essential Duties & Responsibilities including by not limited to:

• Sets the mission, vision, strategy, operating model, and multi-year roadmap for the Cyber Security function, aligning priorities with enterprise strategy, patient safety, digital transformation, risk appetite, and measurable risk reduction.
• Leads, manages, and develops the Cyber Security function and its capabilities, including security architecture and engineering, identity and access management, security operations, vulnerability management, governance, risk and compliance, third-party risk, incident response, and workforce education.
• Establishes and maintains enterprise cyber security policies, standards, control frameworks, risk assessments, asset inventories, risk registers, exception processes, and performance measures aligned with applicable laws, regulations, contractual obligations, and recognized industry frameworks.
• Provides clear reporting and expert advice to executive leadership and appropriate board committees regarding material cyber risks, emerging threats, regulatory obligations, control effectiveness, incident readiness, investment priorities, and remediation progress.
• Oversees security monitoring, threat intelligence, threat hunting, incident response, digital forensics, crisis coordination, ransomware preparedness, business continuity, disaster recovery, clinical downtime readiness, and post-incident improvement activities.
• Drives identity-first and zero-trust security practices and oversees protection of cloud, SaaS, endpoint, email, network, application, API, data, EHR, ERP, digital health, connected medical device, Internet of Medical Things, and operational technology environments.
• Co-leads enterprise AI governance and establishes security requirements for the acquisition, development, deployment, monitoring, and retirement of AI, generative AI, machine learning, agent, copilot, and AI-enabled technologies.
• Maintains an inventory and risk-based oversight process for AI systems and addresses AI-related threats, including prompt injection, sensitive-data leakage, model theft or manipulation, data poisoning, insecure outputs, excessive agency, shadow AI, deepfakes,…