IT Security Governance Lead

Job Description

Stony Brook Medicine is seeking an IT Governance Lead to drive enterprise identity governance, access control, and cloud security strategy. This senior role is responsible for defining and enforcing authorization models, identity governance frameworks, and privileged access controls across cloud and hybrid environments, including clinical platforms such as Oracle Health (Cerner).

This position serves as the information security authority for "who gets access and why," ensuring alignment with Zero Trust principles, least privilege, and regulatory requirements (HIPAA, NYS, SUNY, NIST) while partnering with Systems and Engineering teams for operational execution.

• Establish and enforce cloud access governance policies (RBAC/ABAC)
• Design and oversee authorization models across cloud platforms (OCI and hybrid environments)
• Define and govern access controls for enterprise clinical systems (e.g., Oracle Health / Cerner)
• Lead access certification reviews and enforce least privilege principles
• Govern Privileged Access Management (PAM/PIM) strategy and controls
• Monitor identity risk signals and privileged account activity
• Align identity governance with HIPAA, NYS, SUNY, and NIST frameworks
• Partner with Architecture, Cloud, Application, and Clinical IT teams to ensure secure design
• Enforce segregation of duties (SoD) and access controls

• Determining who should have access and under what conditions
• Defining access control policies and governance standards
• Driving risk-based access decisions and control enforcement
• Ensuring audit readiness and regulatory compliance, including clinical system access

• Conditional Access & MFA
  • Defining governance & policy
• Access Provisioning
  • Defines roles and approval requirements
• Access Reviews
  • Owns certification process
• Identity Incident Response
  • Leads investigation and strategy
• Logging & Monitoring
  • Defines requirements and reviews anomalies

• Separation of authentication (Systems) and authorization (Info Sec)
• Independent governance over privileged and sensitive access, including clinical systems
• Enforced segregation of duties
• Scalable governance model supporting cloud and healthcare platforms (OCI/Cerner)

• Bachelor's degree in Technology (Computer Science, Info Sec, or related field.
• 5+ years of experience in Identity & Access Management (IAM), or Identity Governance such as:
  • Identity Governance & Administration (IGA)
  • RBAC / ABAC models
  • PAM/PIM solutions
  • Cloud platforms (OCI, Azure, AWS, or GCP)

• Direct experience with Oracle Cloud Infrastructure (OCI) and Oracle Health (Cerner) access models
• Experience supporting or securing enterprise healthcare/clinical systems (e.g., Oracle Health / Cerner, Epic, or similar)
• Experience governing access to clinical workflows, sensitive patient data, and provider roles
• Familiarity with Microsoft Entra  / Azure AD governance
• Experience with Zero Trust architectures and conditional access
• Relevant certifications (CISSP, CISM, CRISC, CCSP)
• Understanding:
  • HIPAA Security Rule
  • NIST frameworks (800-53, 800-207)

Resume/CV should be included with the online application.

This position will remain posted until filled or for a maximum of 90 days. An initial review of all applicants will occur two weeks from the posting date. Candidates are advised on the application that for full consideration, applications must be received before the initial review date (which is within two weeks of the posting date).

If within the initial review no candidate was selected to fill the position posted, additional applications will be considered for the posted position; however, the posting will close once a finalist is identified, and at minimal, two weeks after the initial posting date. Please note, that if no candidate were identified and hired within 90 days from initial posting, the posting would close for review, and possibly reposted at a later date.

____________________________________________________

• Stony Brook Medicine is a smoke free environment. Smoking is strictly prohibited anywhere on campus, including parking lots and outdoor areas on the premises.
• All Hospital positions may be subject to changes in pass days and shifts as necessary.
• This position may require the wearing of respiratory protection, which may prohibit the wearing of facial hair.
• This function/position may be designated as "essential." This means that when the Hospital is faced with an institutional emergency, employees in such positions may be required to remain at their work location or to report to work to protect, recover, and continue operations at Stony Brook Medicine, Stony Brook University Hospital and related facilities.

• Successfully complete pre-employment physical examination and obtain medical clearance from Stony Brook…