Director of Cybersecurity

For over 54 years, FHCHC has been an innovative and vibrant community health center, catering to multiple generations with over 165,000 office visits across 21 locations. Guided by a Board of Directors, most of whom are patients themselves, we take pride in being a healthcare leader dedicated to delivering high-quality, affordable medical and dental care to everyone, regardless of their insurance status or ability to pay.

Our extensive range of primary and specialty care services, along with evidence-based programs, empowers patients to make informed choices about their health. As we expand our reach to underserved areas, our commitment to prioritizing patient needs remains unwavering. FHCHC's mission is to enhance the health and social well-being of the communities we serve through equitable, high-quality, and culturally responsive patient-centered care.

The Director of Cybersecurity owns and advances Fair Haven Community Health Center’s (FHCHC) enterprise cybersecurity program. Initially an individual contributor, the Director performs hands‑on security operations (incident response, vulnerability management, email security, data loss prevention, and third‑party risk) while leading strategy, governance, and risk management to protect the confidentiality, integrity, and availability of FHCHC systems and data. The Director will build and lead a cybersecurity team as the function grows.

Reporting to the Vice President, Data & Technology, the Director is FHCHC’s senior cybersecurity leader, combining hands‑on work with strategy, governance, and advising executive and Board stakeholders. Typical duties include but are not limited to:

• Develop and execute a multi-year cybersecurity strategy, roadmap, and measurable objectives aligned with FHCHC’s business needs and risk appetite.
• Report on security posture, risk, incidents, compliance, investments, and cyber insurance to executive leadership, governance committees, and the Board.

• Manage co‑managed security services, assessors, auditors, and vendors, holding them to clear expectations and deliverables.
• Set security requirements for AI and emerging technologies to protect PHI and organizational data, including from public AI models; support AI governance, defend against AI‑enabled attacks, and secure AI models and data pipelines.

• Lead and perform threat monitoring using SIEM, IDS/IPS, EDR, email security, DLP, and related tools.
• Lead incident and breach response, including containment, eradication, recovery, evidence handling, executive reporting, and post‑incident review.
• Provide or coordinate after‑hours response for material incidents and maintain escalation and on‑call procedures.

• Perform and direct vulnerability scanning, prioritization, remediation validation, and penetration testing.
• Lead enterprise cyber risk assessments, maintain a prioritized risk register, and recommend practical mitigations with accountable remediation plans.
• Set security requirements and verify that system owners patch, update, and harden systems.

• Define security architecture principles, control requirements, and standards with IT and clinical technology teams.
• Oversee the operation and improvement of firewalls, access controls, IDS/IPS, endpoint protection, DLP, logging, and other security technologies.
• Provide governance over identity and access management, privileged access, and authentication.
• Embed security requirements into project intake, procurement, cloud adoption, system design, change management, and software delivery.