Cybersecurity Lead - HIPAA

Select how often (in days) to receive an alert:
Create Alert

Additional Location(s):US-MA-Marlborough; US-MN-Arden Hills

Diversity - Innovation - Caring - Global Collaboration - Winning Spirit
- High Performance

At Boston Scientific, we’ll give you the opportunity to harness all that’s within you by working in teams of diverse and high-performing employees, tackling some of the most important health industry challenges. With access to the latest tools, information and training, we’ll help you in advancing your skills and career. Here, you’ll be supported in progressing – whatever your ambitions.

About the role:

Boston Scientific is seeking an experienced cybersecurity HIPAA leader to be part of the Cybersecurity Governance Risk and Compliance (GRC) team as HIPAA Cybersecurity Lead. In this key role, this individual will oversee GRC initiatives focused on ensuring compliance with information security and cybersecurity regulations, with particular emphasis on HIPAA Security Rules. They will be instrumental in strengthening our security posture across the enterprise.

The HIPAA Cybersecurity Lead will serve as a senior technical leader responsible for maintaining compliance with HIPAA, PIPL, NIS2 Directive, CPRA, CCPA, and other domestic and global data privacy regulations, including Consumer Privacy and Information Protection Laws (CPIPL). This role will drive privacy-by-design and security-by-design principles across enterprise systems, assess risk, and implement data protection solutions. The analyst will collaborate with cross-functional teams to further embed security into technical environments and business processes.

Your responsibilities will include:

• Lead the development and implementation of cybersecurity and security frameworks aligned with HIPAA, PIPL, GDPR, and other applicable regulations.
• Develop, implement, and enforce policies and procedures for compliance with HIPAA regulations including Security Rule controls.
• Oversee the implementation of technical solutions to protect data, including encryption, access controls, and secure data transmission.
• Conduct regular risk assessments and reviews to identify potential vulnerabilities and maintain compliance with HIPAA standards.
• Participate, consult, and work closely with IT, legal, compliance, and business units regarding potential incidents and appropriate follow up measures.
• Provide training and resources to staff on HIPAA compliance and best practices for data security.
• Work closely with cross functional teams including IT, legal, Compliance, Privacy and other departments.
• Oversee compliance with industry best practices, and regulatory requirements including HIPAA/HITECH, PCI-DSS and ISO 27001 and update organizational policies and procedures accordingly.
• Perform periodic risk assessments of third-party vendors and ongoing compliance monitoring activities
• Lead and support HIPAA Security Risk analyses and compliance efforts under the HIPAA Security Rule
• Assess information system configurations to validate information assets are protected in accordance with applicable security requirements, policies, and industry standards.
• Serve as a company-wide resource and liaison on policies, HIPAA controls and provisions, communications, workflow, and quality improvement initiatives. Act as a subject matter expert on data protection, security controls, information security, and risk mitigation strategies.
• Oversee vendor risk assessments and validate third-party compliance with HIPAA security standards.
• Collaborate with legal, compliance, and IT teams to translate privacy policies into technical requirements.
• Stay current with emerging threats, regulatory changes, and best practices in cybersecurity and data privacy.
• Perform regular audits and assessments of systems to validate compliance with data protection regulations.
• Advise on technical and organizational measures and data transfer mechanisms.
• Support mergers and acquisitions by assessing security risks of target organizations.

Required Qualifications:

• Education:
  
  Bachelor’s or Master’s degree in Cybersecurity, Computer Science, or related field.
• Experience:
  
  8+ years of experience in Information Security, IT Risk, or…