Director of Information Security Assurance

HCA Healthcare - Charleston, SC

Full-time - Senior

Charleston, SC

1,001-5,000 employees

Hospitals

About the position

The Director of Information Security Assurance (DISA) leads the Information Protection & Security (IPS) program at HCA Healthcare, focusing on risk management, compliance, and the protection of patient data. This role involves collaborating with various stakeholders to implement security controls, manage security events, and ensure adherence to IPS requirements while supporting patient care and business objectives. The DISA is responsible for overseeing the assessment of security controls, managing operational processes, and fostering relationships with key stakeholders to enhance the effectiveness of the IPS program.

Responsibilities

• Implement and manage risk management activities to align with the IPS program.
• Establish and maintain strategic relationships with key stakeholders to accomplish IPS objectives.
• Lead the IPS risk management program using corporate-provided tools and templates.
• Guide risk-based decisions to prevent or correct identified security risks.
• Provide leadership for acquisition or divestiture due diligence efforts.
• Represent IPS needs in local strategic planning and budgeting.
• Collaborate with other IPS leaders for consistency in the IPS program.
• Manage operational processes that monitor and respond to potential security threats.
• Partner with corporate departments for rapid response to security events.
• Lead education and consultation activities for workforce members with risky behaviors.
• Build relationships to influence decisions that protect the company.
• Oversee processes for review and approval of security exception requests.
• Ensure proper vendor contracts and security terms are in place for systems and services.
• Coordinate with HR and training departments for workforce training on IPS content.
• Recruit and manage IPS staff, ensuring appropriate training and development.

Requirements

• Bachelor's degree required.
• Master's degree preferred.
• 7+ years of experience in a relevant field required.
• 7+ years of experience in security risk management, information security domains, and/or hospital operations preferred.
• 3+ years of experience in management required.
• Significant experience in developing and assessing technical and process-based controls.
• Experience in management and/or operations in healthcare business or IT functional areas required.
• Experience in audit, risk management, information security, privacy, and information technology required.
• Strong leadership skills and ability to see projects through to execution in a matrixed environment required.
• Ability to communicate effectively at an executive level required.

Nice-to-haves

• CISSP, CISA, HCISPP, CHC, CHPC, CHSP, CISM or other relevant certifications in information security or privacy preferred.

Benefits

• 401(k) matching
• Adoption assistance
• Dental insurance
• Disability insurance
• Employee stock purchase plan
• Comprehensive medical coverage
• Flexible spending accounts
• Life and disability coverage
• Supplemental health protection plans
• Free counseling services
• Education assistance
• Time Away From Work Program
• Employee Health Assistance Fund