Senior IT Security Vulnerability Management Engineer - CBO IT Security

Job Description

The Security Professional supports the Information Security department's goals and objectives by performing multiple technical or functional roles. Information Security's goals and objectives are to develop information, computer, network, product, application and related business security policies, and mandate minimum security standards for The Christ Hospital Health Network (TCHHN) and its associated businesses and or partners; facilitate or implement tasks or processes in support of security policies and standards;

and assess compliance with such TCHHN Security policies. The security professional will actively promote awareness of these Security Policies and related security topics throughout TCHHN. Additionally the security professional will act as a subject matter expert for the CISO and perform governance, risk management and compliance (GRC) as required.

• Tracks and manages information security risks and identifies information security vulnerabilities and facilitates required remediation activities
• Perform risk and security impact analysis to address compliance with applicable laws, regulations, requirements and to effect positive financial security investment
• Manage or facilitate compliance audits and or investigation
• Designs and implements internal controls/standards & procedures that ensure compliance with security standards that meet existing regulatory security requirement
• Contributes to the development of policies and standards as needed to reflect evolving TCHHN need
• Coordinates and conducts internal security audits to ensure the effectiveness of TCH's security parameter
• Participates and advises in TCHHN risk programs.

• Ensures the confidentiality, integrity and availability of current information systems appropriately utilizes resources to protect data (HIPAA/HITECH/PCI/PII, etc.)
• Implement commercially reasonable information security solutions in line with business goals and strategies
• Resolves operational conflicts that arise between projects and daily operation
• Manage stakeholder expectations, understand business priorities and communicate security approaches and or requirements appropriately
• Implement approved service requests according to standard procedure
• Review change requests with information security impact and provide direction
• Execute changes in a controlled, organized manner following established change management processes
• Manage, monitor, execute security operational tools to include (but not limited to):
• Intrusion Prevention Systems/next generation firewall
• Web Content Filter
• Advanced Persistent Threat systems and analysis
• Forensic toolset
• Advanced next generation anti-virus & malware toolset
• Email security virtual appliance
• Logging/Monitoring/Incident Detection system
• Monitoring and executing routine information security processes and ticket
• Manage information security incidents and problems to agreed service level
• Monitoring KPI's on a continuous basis to ensure information security controls meet business need
• Ensures that technology projects are properly planned, managed, and executed

• Mentoring security team members as assigned
• Ability to establish work standards, prioritize and deliver on key initiative
• Assist in the development of awareness training and communication programs to effectively communicate company security and privacy policy
• Fosters a service oriented atmosphere of teamwork between the business and IT
• Must be a professional of unquestionable integrity, credibility, business ethics and character
• Must be self-directed, take ownership & responsibility and ensure high quality output
• Outstanding communication skills with a demonstrated ability to connect with people on business needs, infrastructure issue resolution and projects

• Communicates with team in order to convey risk related to specific lines of business within the Hospital and that deal with legal, compliance, personnel security, public relations and other issues directly tied to security risk
• Performs project management functions as needed or required
• Stays current on HIPAA, HITECH, PCI and other relevant security regulations
• Performs other duties as necessary or assigned by the Chief Information Security Officer and Executive Management

Please describe any specialized knowledge or skills, which are REQUIRED to perform the position duties. Do not personalize the job description, credentials, or knowledge and skills based on the current associate. List any special education required for this position.

EDUCATION:

Bachelor of Science degree in business/technical discipline

YEARS OF

EXPERIENCE:

Five (5) plus of related professional security experience

• Information Security
• Information Technology
• Project Management
• Business or Security Informatics
• Audit & Assurance
• Enterprise Risk Management
• Corporate Compliance
• Security Architecture/design strategy
• Compliance readiness assessments