Consulting Security Consultant

Primarily responsible for the development and implementation of enterprise security policy and standards as identified and authorized by the Director, IS Customer Solutions, as well as required by federal and state regulatory bodies. Also accountable for developing and implementing security tools necessary to facilitate enterprise-wide policy and standards compliance, while creating processes to manage and mitigate security risk. Individual will work independently, as well as in cooperation with other IS teams and Company stakeholders to define security practices necessary to achieve an appropriate electronic asset protection level. Additionally, the individual will assist in the overall security budget process to help ensure the security program is focused on high-risk areas for effective and efficient deployment of resources.
Lead the creation and renewal of Information Security (IS) policy and standards to help ensure information integrity, confidentiality and availability. Research industry best practices and stay abreast of regulatory activities; Recommend and write platform-independent security policy, standards, tools, and techniques based upon risk assessment results, best practices and regulatory interpretations; Define enterprise level security roles and responsibilities necessary for implementation of policy and standards; Develop and facilitate tools and techniques necessary for implementation of security policy and standards; Collaborate and accomplish work by leveraging Company relationships (e.g., IT&S resources, business owners, etc.); and Assist in developing a communication plan for effectively communicating approved policy, standards, tools, and techniques to the enterprise. Serve as an Information Security (IS) consultant, providing enterprise-wide information security guidance:
Consult with project managers to help ensure global protection of information assets during system design, development, and implementation; Educate Company stakeholders on information security through the Information Security training and education program; and Assist in interpreting security policy and standards, as well as resolving security policy issues. Facilitate creation of an enterprise Information Security (IS) methodology and facility based approach to mitigate vulnerabilities and threats: Lead efforts to provide an overall IS policy and standards compliance/monitoring program; Research best practices on security compliance/monitoring programs such as compliance with industry standards; and Provide management updates on implementation issues and policy and standards compliance as a part of a total risk assessment program.

REQUIREMENTS


5-7 years experience in Information Systems with a minimum of 3 years experience administering, auditing, and/or managing enterprise security programs and/or security policies, procedures, standards, and guidelines.


Information Security professional certifications are preferred.



Healthcare industry experience preferred.



Knowledge of:
Federal and state laws regarding protection of electronic information assets, within the context of the healthcare industry is preferred (e.g., HIPAA, Sarbanes-Oxley, etc.); Industry security standards (e.g., NIST), with healthcare industry standards such as CMS, JCAHO, etc. preferred; Platform independent security policy and standards; E-business security strategies, policies, and standards; Compliance programs for Enterprise security policy and standards; and Risk methodology processes to protect electronic information assets.

Skills including:Superior analytical skills; Ability to balance protection of electronic information assets with the need to enable users to effectively and efficiently use systems to perform job responsibilities, while continuing to emphasize quality patient care; Strong customer service focus and ability to manage facility expectations and needs; Solid project management and collaboration skills;
Excellent oral and written communication skills with the ability to present and discuss technical information in a manner that establishes rapport and persuades others, while increasing the individual's understanding of the subject matter; and Taking initiative toward personal development such as maintaining skills and obtaining professional certifications.