Enterprise Cybersecurity Architect

The Enterprise Cybersecurity Architect will design and maintain PAM Health’s enterprise security architecture for a multi-state post-acute health system. This role develops security standards and reference architectures, conducts threat modeling and architecture reviews, and provides senior security subject matter expertise across IT, clinical, and business teams.

• Develop, maintain, and govern PAM Health’s enterprise security architecture, technical security standards, design patterns, and reference architectures.
• Establish secure architecture standards for cloud, identity, network, endpoint, application security, data protection, logging, monitoring, and incident response.

• Review enterprise, cloud, clinical, network, application, data, artificial intelligence, and medical device initiatives to ensure security requirements are incorporated prior to implementation.
• Conduct threat modeling and security design reviews for new systems, major changes, integrations, and third-party solutions.
• Define security requirements and architecture guardrails aligned with the NIST Cybersecurity Framework, HIPAA Security Rule, MITRE ATT&CK, OWASP guidance, and applicable regulatory requirements.

• Identify architectural risks, document required controls, recommend remediation, and communicate business and clinical impact to technical and executive stakeholders.

• Partner with Information Technology, Network Operations, Clinical Informatics, Compliance, Privacy, Legal, and business leaders to integrate security into technology strategy and project delivery.
• Provide technical direction and oversight to managed security service providers, technology vendors, consultants, and other third parties.

• Support application security through secure development requirements, architecture reviews, vulnerability management, penetration testing, and remediation guidance.
• Evaluate the security of artificial intelligence and machine learning systems, including data protection, access control, model risk, third-party dependencies, and misuse scenarios.
• Assess medical devices and connected clinical technologies for cybersecurity risk and recommend compensating controls when remediation is limited.

• Support security incidents by providing architecture analysis, containment guidance, root-cause review, and recommendations to prevent recurrence.
• Maintain current knowledge of emerging threats, security technologies, healthcare cybersecurity requirements, and industry practices.
• Mentor security and information technology staff and promote consistent application of PAM Health security standards across the enterprise.

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Information Systems, or a related technical field, or an equivalent combination of education and experience.
• Certified Information Systems Security Professional (CISSP) must be obtained within six (6) months of hire and maintained in good standing.
• Ten (10) years of progressive experience in cybersecurity.
• Seven (7) years of cybersecurity experience in healthcare, including provider, health system, or comparably regulated clinical environments.
• Five (5) years in a security architecture or senior technical role.
• Three (3) years of application security experience.
• Experience providing technical direction to third-party security providers and managed security service providers.

• Medical device and connected clinical device security experience.
• Offensive security experience,…