Executive Director IT Security & CISO

Who We Are
JPS Health Network is a $950 million, tax-supported healthcare system in North Texas. Licensed for 582 beds, the network features over 25 locations across Tarrant County, with John Peter Smith Hospital a Level I Trauma Center, Tarrant County's only psychiatric emergency center, and the largest hospital-based family medical residency program in the nation. The health network employs more than 7,200 people.

Acclaim Multispecialty Group is the medical practice group featuring over 300 providers serving JPS Health Network. Specialties range from primary care to general surgery and trauma. The Acclaim Multispecialty Group formed around a common set of incentives and expectations supporting the operational, financial, and clinical performance outcomes of the network. Our goal is to provide high quality, compassionate clinical care for every patient, every time.

Why JPS?
We're more than a hospital. We're 7,200 of the most dedicated people you could ever meet. Our goal is to make sure the people of our community get the care they need and deserve. As community stewards, we abide by three Rules of the Road:

• Own it. Everyone who wears the JPS badge contributes to our journey to excellence.
• Seek joy. Every day, every shift, we celebrate our patients, smile, and emphasize positivity.
• Don't be a jerk. Everyone is treated with courtesy and respect. Smiling, laughter, compassion - key components of our everyday experience at JPS.

When working here, you're surrounded by passion, diversity, and dedication. We look forward to meeting you!

For more information, visit (Use the "Apply for this Job" box below). To view all job vacancies, visit  , ,or .

Job Summary: The Executive Director IT Security & CISO provides strategic leadership for the organization's enterprise information security and cyber resilience program. Reporting to the SVP Chief Information Officer, this role serves as the HIPAA Security Official and is accountable for cybersecurity strategy, governance, architecture, operations, identity and access management, data protection, incident response, regulatory compliance, and third-party risk management. The Exec Dir IT Security & CISO leads the security organization, partners across clinical and business functions, and advises executive leadership and the Board on cybersecurity risk and resilience.

Essential Job Functions & Accountabilities:

• Develops and executes the enterprise information security strategy and multi-year roadmap, defines the enterprise cybersecurity risk appetite in coordination with executive leadership and the Board, and ensures alignment with clinical, operational, and financial priorities.
• Establishes and maintains the information security governance framework covering policies, standards, procedures, exceptions, and control ownership, and directs alignment with the NIST Cybersecurity Framework, NIST 800-53, and HITRUST.
• Serves as the designated HIPAA Security Official with overall final responsibility for the security of electronic protected health information.
• Reports information security posture, risk, and program performance to the CEO, SVP Chief Information Officer, executive leadership, and the Board, and leads ongoing cybersecurity education to strengthen executive and Board risk literacy.
• Partners with the IT Security Risk Manager in the Office of Legal Affairs as the independent second-line risk oversight function, receives independent risk review findings, and drives remediation to closure.
• Directs security architecture across cloud, on-premises, hybrid, and as-a-service environments and owns the Zero Trust roadmap across identity, network, workload, endpoint, and device domains.
• Directs the enterprise Identity and Access Management program through the IAM Manager, including role-based access, access certification, multi-factor authentication, single sign-on, and Privileged Access Management.
• Directs security operations, security engineering, endpoint protection, vulnerability management, patch management, threat detection, and coordination with Managed Security Service Providers through the Security Manager.
• Directs enterprise data protection strategy covering classification, encryption, key management, Data Loss Prevention, backup and recovery security controls, and controls for inter-organization, intra-organization, and extra-organization clinical data movement.
• Directs the insider threat program and partners with the Office of Legal Affairs, Compliance, and Research on data governance for secondary data use, analytics, and artificial intelligence model training.
• Owns the enterprise cybersecurity incident response program including plan development, playbook maintenance, tabletop and functional exercises, and leads the technical response to active incidents in partnership with the Office of Legal Affairs, which owns HIPAA breach notification to the Office for Civil Rights and affected individuals.
• Partners with Clinical Operations and IT…