Director of Security & Compliance/ CISO

Demonstrated experience with security operations, incident response, identity security, security architecture, clinical/EHR environments, healthcare regulations, risk-based investment planning, and cross-functional remediation * Strong executive communication and collaboration with Compliance, Privacy, clinical leaders, and shared-service providers; healthcare/public-sector experience preferred. * Own the enterprise cybersecurity portfolio: identify capability gaps; develop business cases and investment priorities; sponsor and govern security programs/projects; establish milestones, budgets, staffing/vendor plans, dependencies, measurable outcomes, and benefit realization; report progress and resolve delivery barriers.

Seeking a Director of Security & Compliance/ CISO for a 6+ month contract role located in Ventura, CA. Role will require 2-3 days a week onsite. Previous experience in a similar role in a clinical healthcare environment is required. Position Summary The CISO is the executive leader responsible for developing, operating, and continuously improving the enterprise information security and cybersecurity program. This role sets a risk-based, multiyear security strategy; oversees cybersecurity investments, initiatives, and daily operations; and safeguards patient care, sensitive information, clinical technologies, and essential health services. The CISO also owns security-related regulatory compliance and serves as the central IT liaison and gatekeeper for technology related compliance issues originating with the Compliance Officer, Privacy, clinical and business operations, auditors, regulators, and County/Agency leadership. The CISO manages intake, prioritization, risk visibility, RAFT tracking, remediation coordination, and timely escalation; technology and business owners remain responsible for executing and sustaining their assigned controls. Essential Responsibilities 1. Enterprise Cybersecurity Strategy, Program & Portfolio Leadership - 40% * Develop, execute, and annually refresh an enterprise cybersecurity strategy, target-state security architecture, policies, standards, operating model, and risk-based three-to-five-year roadmap aligned with clinical operations, patient safety, business priorities, and NIST CSF/HIPAA Security requirements. * Own the enterprise cybersecurity portfolio: identify capability gaps; develop business cases and investment priorities; sponsor and govern security programs/projects; establish milestones, budgets, staffing/vendor plans, dependencies, measurable outcomes, and benefit realization; report progress and resolve delivery barriers. * Direct day-to-day security operations and continuous improvement across security monitoring/SOC and SIEM, incident detection and response, threat intelligence, endpoint/XDR, vulnerability and exposure management, patch-risk governance, security configuration, and penetration testing. * Lead identity and access security strategy, including MFA, privileged access, role-based access governance, periodic access reviews, and security controls for EHR and clinical systems; partner with application and infrastructure teams responsible for implementation. * Establish security architecture and control requirements for networks/segmentation, cloud, remote access, third parties, data protection/encryption, AI, IoMT/medical devices, and integration platforms; review major technology designs and changes. * Own cybersecurity incident readiness, ransomware resilience, security investigations and response coordination, cyber recovery requirements, tabletop exercises, and post-incident improvement; integrate with enterprise emergency management and disaster recovery owners. * Conduct enterprise security risk assessments and HIPAA Security Rule risk analyses; manage security policy compliance, security awareness, vendor cybersecurity risk, and remediation of security control gaps. * Build a security performance and maturity measurement program using KPIs/KRIs, control testing, roadmap delivery, incident trends, vulnerability aging, third-party exposure, and executive/board-ready reporting. * Coordinate security initiatives and operational service expectations with County IT, clinical engineering, application owners, and external partners, while preserving clear accountability for shared infrastructure and systems. 2. Enterprise IT Compliance Intake, Gatekeeping & Compliance Officer Partnership - 20% * Serve as the primary IT relationship manager to the Agency Compliance Officer and central intake/triage point for technology-related compliance issues; establish acknowledgment, classification, ownership, prioritization, communications, and closure standards. * Coordinate IT responses involving privacy-related controls, PCI DSS, access, records retention, accessibility, EHR billing/documentation, clinical-system regulations, CMS and California requirements, disaster recovery, County/Agency policies, investigations, and corrective actions. * Hold recurring working sessions with Compliance and IT leaders; translate findings into actionable technology requirements, secure accountable owners, negotiate realistic resolution plans, and proactively manage regulatory deadlines and dependencies. * Preserve the authority of Compliance, Privacy, Legal, HIM, Revenue Cycle, clinical/business owners, and designated investigators over regulatory interpretation, investigations, and business decisions. 3. Risk Registry, RAFT & Corrective-Action Governance - 15% * Own the centralized IT compliance and technology risk registry and formal RAFT (Risk, Action, Follow-up, and Tracking) workflow, aligned with Agency terminology and approved standards. * Record issue source, requirement, severity, patient/operational impact, accountable business/IT owners, interim safeguards, remediation plan, milestones, due dates, dependencies, evidence, residual risk, and authorized acceptance decisions. * Coordinate mitigation timelines and corrective actions with IT Directors and County IT; monitor aging, overdue items, resource constraints, validation evidence, and effectiveness through documented closure. * Prioritize jointly with the Compliance Officer and CIO based on patient safety, regulatory obligations, privacy, financial exposure, operational continuity, and feasibility; escalate risks appropriately. 4. Audit, Investigations & Regulatory Readiness - 10% * Coordinate technology audit readiness, control assessments, technical evidence, system logs, investigation support, responses, management action plans, and verification of corrective actions. * Protect investigation confidentiality and evidence integrity; maintain Internal Audit independence and promptly refer reporting/notification deadlines to designated responsible officials. 5. Technology Risk, Resilience & Operational Control Oversight - 10% * Assess security and technology risks for procurements, vendors, cloud, new clinical systems, integrations, AI, and connected medical devices. * Monitor risks related to change management, system access, asset/software licensing, EOL/EOS, backups, disaster recovery, continuity dependencies, vendor controls, and County-managed infrastructure; coordinate remediation with accountable operators. 6. Leadership, Executive Reporting & Collaboration - 5% * Lead, coach, and develop cybersecurity and IT GRC personnel; manage program capacity, skills, vendor relationships, and performance. * Provide the CIO and Compliance Officer with dashboards covering security program maturity, cybersecurity portfolio delivery, threat/risk posture, compliance exposure, RAFT status, overdue actions, and remediation progress. * Participate in enterprise technology, clinical, risk, AI, and compliance governance; address issues at the appropriate level while promptly escalating material, patient-safety, legally reportable, or unresolved risks. Decision Rights & Accountability The CISO owns cybersecurity strategy, program delivery, security operations oversight, security-related compliance, and IT compliance intake/RAFT coordination. IT Directors, County IT, and system owners own technical implementation and sustained operations. The Compliance Officer, Privacy Officer, Legal, clinical and business leaders retain their designated regulatory and business authorities. The CIO owns enterprise IT prioritization, resources, and executive technology-risk decisions; Internal Audit remains independent. Qualifications * Bachelor"s degree in cybersecurity, IT, computer science, healthcare administration, business, or related discipline; advanced degree preferred. * 10+ years of progressive IT/security/risk experience with 5+ years leading cybersecurity teams or programs; proven record building a mature enterprise security program and delivering a multiyear cybersecurity portfolio. * Demonstrated experience with security operations, incident response, identity security, security architecture, clinical/EHR environments, healthcare regulations, risk-based investment planning, and cross-functional remediation * Strong executive communication and collaboration with Compliance, Privacy, clinical leaders, and shared-service providers; healthcare/public-sector experience preferred. CISSP, CISM, CISA, CRISC, HCISPP or equivalent preferred. Illustrative Performance Measures * Annual cybersecurity strategy/roadmap refresh; quarterly portfolio delivery and investment reporting against approved milestones. * Improved security maturity and measurable performance across threat detection/response, critical vulnerability remediation, access controls, third-party risk, and incident preparedness. * Documented annual HIPAA Security risk analysis and risk-based security remediation plans. * 100% of incoming material IT compliance issues registered, assigned, prioritized, and tracked. * Risk-ranked RAFT plans for material findings; monthly review of overdue actions with Compliance and IT leadership. * Regulatory deadlines met or escalated in advance; evidence-based closure and documented authorized risk acceptance.