Director of Cybersecurity Programs & Deputy BISO

Location:

Chicago, Illinois
Business Unit:
Rush Medical Center
Hospital:
Rush University Medical Center
Department:
Digital & Information Services
Work Type:
Full Time (Total FTE between 0.9 and 1.0)

Shift: Shift 1

Work Schedule:

8 Hr (8:00:00 AM - 5:00:00 PM)
Rush offers exceptional rewards and benefits learn more at our Rush benefits page (https://(Use the "Apply for this Job" box below).).
Pay Range: $69.41 - $103.42 per hour
Rush salaries are determined by many factors including, but not limited to, education, job-related experience and skills, as well as internal equity and industry specific market data. The pay range for each role reflects Rush’s anticipated wage or salary reasonably expected to be offered for the position. Offers may vary depending on the circumstances of each case.

As a key member of the Information Security leadership team, you will lead several high-impact cybersecurity functions, including Cybersecurity Education & Awareness, Security Program Management, Vendor Management, and the Business Information Security Officer (BISO) program. You will drive enterprise-wide initiatives that strengthen security culture, reduce organizational risk, and ensure cybersecurity remains aligned with the strategic goals of the health system. Working closely with executive leadership, operational teams, and business stakeholders, you will influence how cybersecurity is understood, adopted, and embedded throughout the organization.

This role offers a unique opportunity to lead transformational cybersecurity programs that impact thousands of users across the Rush system. From developing innovative security awareness strategies and measuring behavioral change to guiding cybersecurity investments, vendor partnerships, and enterprise risk initiatives, you will help advance a mature, forward-thinking cybersecurity program while serving as a visible ambassador for Information Security both internally and within the broader industry.

The ideal candidate is a collaborative and influential cybersecurity leader with deep expertise in information security, governance, risk management, program leadership, and stakeholder engagement. If you are passionate about building security-conscious cultures, driving strategic initiatives, and making a meaningful impact in healthcare, we invite you to join Rush and help strengthen the security and resilience of an organization dedicated to transforming health care.

• Develop and implement a strategy, goals, and objectives for the cybersecurity training, education, and awareness program. This program addresses current and emerging technologies and risks affecting all RUSH employees, students, faculty, and contingent workers.
• Identifies the human and cultural behaviors Rush needs to change to mitigate the top cybersecurity risks to our organization.
• Manages the team responsible for tailoring information security training, education, and awareness programs to reduce institutional risk related to lack of training that includes applicable compliance objectives (e.g., HIPAA, FERPA, PCI).
• Ensure that RUSH’s information security awareness program communicates RUSH’s security policies and requirements through a central repository available to RUSH stakeholders.
• Develop and track metrics framework (including KPIs/KRIs) that effectively measures employee engagement, behaviors, and impact. This framework should show progress towards effectively changing employee behaviors to act more securely, thus reducing risk to RUSH.
• Establishes and manages relationships with external vendors and agency partners as needed to establish quotes, production schedules, delivery, and implementation of cyber education and awareness materials.
• Oversees the corporate phishing program, including maintaining the IT systems, tools, and technology needed to run a phishing campaign successfully.
• Provide guidance and oversight for cybersecurity communication memos, emails, user guides, etc.
• Establishes strong relationships with RUSH Marketing and Communication, collaborates on important cybersecurity initiatives, and disseminates awareness materials.
• Accountable for coordinating systemwide, departmental, and team events, including lunch and learns, all-hands meetings, holiday parties, etc.
• Attends RUSH system-wide presentations, workshops, and trainings to best represent the Information Security Department and its key initiatives that protect RUSH stakeholders.