Director of IPS Risk Management

This position is incentive eligible. Introduction Do you want to join an organization that invests in you as a Director of Information Protection Security and Risk? At HCA, you come first. HCA Healthcare has committed up to $300 million in programs to support our incredible team members over the course of three years. Benefits At HCA, we want to ensure your needs are met. We offer eligible colleagues an attractive benefit package that includes medical, wellbeing, dental and vision benefits along with some unique benefits including: Medical, Dental, Vision, Life Insurance and Flexible SpendingPaid Time Off (PTO) and Personal Leave401K (100% annual match - 3% to 9% of pay based on years of service)Academic Assistance and Reimbursements for Tuition and Student LoansEmployee Discounts including Tickets, Retail, Mental Health Apps, Education Apps, Identity Theft Protection etc.Home, Auto, and Pet InsuranceEmployee Stock Purchase Program (ESPP)Short Term & Long Term Disability coverageAdoption AssistanceLegal Benefits and lots more! Learn more about Employee Benefits You contribute to our success. Every role has an impact on our patients lives and you have the opportunity to make a difference. We are looking for a dedicated Director of Information Protection Security and Risk like you to be a part of our team. Job Summary and Qualifications The Director of Information Protection & Security (IPS) Risk Management leads the risk management function for IPS. In this critical leadership position, you will be responsible for developing and overseeing our organization's comprehensive cybersecurity risk management program. This role will be responsible for developing and implementing a robust cybersecurity risk management strategy aligned with industry best practices and evolving threats. To be successful in this role, the Director of Risk Management must be able to clearly communicate cyber risks to all levels of the organization. This leader will be key in implementing a risk management program that results in the identification, prioritization, and reduction of cybersecurity and ensures compliance for all in-scope facilities. This trusted advisor will help raise the protection bar by building strong relationships with technical and non-technical stakeholders to make risk visible, facilitate well-informed decision, and drive accountability. The ability to clearly communicate and report cybersecurity risk, and manage organizational relationships, will be key to the success of this role. In addition, this role must be able to establish a outcome-driven metrics approach to risk management and utilize protection level agreements as a mechanism to establish risk thresholds. This position is expected to promote a culture that supports operating with an acceptable level of risk, developing standardized risk management criteria including but not limited to threats, vulnerabilities, likelihood, impact, and maturity, establishing risk tolerance, planning risk analysis (e.g. Meaningful Use Security Risk Analyses, HIPAA), and managing risk assessment activities (e.g. HIPAA, PCI, NIST Cyber Security Framework). In addition, this position will ensure all parts of the risk management program are documented. It will also ensure a strategy for using and maintaining the risk register to prioritize risk reduction actions and activities is implemented. This position is also responsible for evolving the organizations current risk treatment framework. This position is also responsible for collaborating with Information Security on the development, configuration, and implementation of the Risk Management Archer GRC application. This position requires a candidate who can, with minimal guidance, analyze business requirements and processes, understand colleague behaviors, facilitate and lead meetings with key stakeholders within the organization, provide industry expertise and knowledge in the identification and mitigation of organizational risk, and enable decision making to support the adherence to industry standards and federal regulations. The Director of IPS Risk Management provides guidance, direction, and mentorship to staff members to support the overall team goals and deliverables. A qualified candidate must be a highly motivated self-starter and be committed to delivering quality outcomes that meet team and organizational goals. What you will do in this role: Quality Work as part of the IPS departments leadership team to develop company requirements, strategies, priorities, processes, implementation plans, and assurance necessary to protect the company against information protection and security risks that could impact patients, employees, and the financial success of the businessRemain knowledgeable of legislative, regulatory, contractual, and other compliance requirements (e.g. HIPAA, PCI, SOX, Joint Commission) as well as departmental policies, standards, and procedures and participating in revision processesDevelop and lead the strategy to mature the risk management roadmap, create new roadmaps where needed, and ensure all roadmaps align with business objectives for the key focus areasProvide periodic analysis of Company IPS-related risk position, based on analysis of current controls status and current threat landscapesMonitor developments in related industries and communicate on the potential impact on or applicability to the organizationEnsure metrics are identified within risk management and remediation strategy that help demonstrate risk reduction and report progress to IPS leadership and company executive leadershipDevelop risk register and be aware of associated remediation plans to respond to previously unidentified or inadequately addressed risk areasBuild rapport, credibility, and cohesion across IPS and other stakeholders across the enterprisePartner with Internal Audit and IPS Leadership to ensure periodic reviews of the risk management program are performed to obtain independent assessments of the programs effectivenessPartner with key stakeholders (e.g. Security Architects, DISAs) within IPS as well as with Internal Audit, Enterprise Risk Management, Legal, and ITG to ensure appropriate oversight and governance of the programEnsure the team is involving all relevant stakeholders in major decisions; recognizing multiple agendas and making/communicating final decisions in ways that foster maximum ownership and minimum resistance Service Lead the team in providing risk-based security perspective through consulting and collaborationLead the team in facilitating and guiding business decisions and solutionsPeople Accountable for the successful completion of organizational objectives through team membersEstablish mutual objectives and targets for team membersMentor team members, including developing and monitoring their personal development plans, and provide feedback via the annual performance review processPromote a culture of collaboration, work/life balance, and open communicationEncourage new ways of thinking and problem solvingCreate a team environment where members embrace change and adopt new practicesStay engaged with team members through 1:1s, rounding, and performance review activities Growth Monitor developments in related industries and communicate on the potential impact on or applicability to the organizationBuild rapport, credibility, and cohesion within IPS and with other stakeholders across the enterpriseParticipate in educational opportunities to build and maintain team knowledge of evolving risk, information security, and privacy concepts Finance Responsible for ensuring proposed future work efforts/projects are appropriately captured with labor and spend estimates and submitted for leadership prioritization and funding What qualifications you will need: Bachelors degree requiredMasters degree preferred3+ year(s) of leadership experience7+ years of experience in information technology, information security, privacy, and/or healthcareCISSP preferred CISA preferred CRISC preferred HCA Healthcare has been recognized as one of the Worlds Most Ethical Companies by the Ethisphere Institute more than ten times. In recent years, HCA Healthcare spent an estimated $3.7 billion in cost for the delivery of charitable care, uninsured discounts, and other uncompensated expenses. "Good people beget good people."- Dr. Thomas Frist, Sr. HCA Healthcare Co-Founder We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. Apply share Share Email X Facebook LinkedIn bookmark_border Save Job bookmark Unsave Job