Director of Information Security

Key Responsibilities

Security Program Leadership and Governance

• Establish and maintain the enterprise security strategy, governance structure, multiyear roadmap and annual implementation plan aligned with NYGC’s mission, operational needs, and risk priorities.
• Author, maintain, and coordinate approval of security policies, standards, and procedures.
• Establish processes for policy reviews, implementation, exceptions, and documented approvals.
• Translate organizational priorities and risk assessments into security objectives, investment proposals, and measurable outcomes.
• Lead security budget development proposals, resource plans, technology selection, and service-provider strategy.
• Present security performance, material risks, resource needs, and strategic recommendations to executive leadership.

Enterprise Risk Management and Compliance

• Establish the security risk assessment methodology, risk register, reporting structure, escalation criteria and remediation tracking.
• Lead a security program aligned with the NIST Cybersecurity Framework, including current-state assessments, target-state planning, and prioritized improvement initiatives.
• Integrate security risk reporting with organizational governance, budgeting, and planning.
• Lead security activities supporting applicable HIPAA Security Rule compliance, in partnership with privacy, legal, compliance, and operational stakeholders.
• Hold security audits, control assessments, evidence management, and corrective action programs.
• Establish and manage third-party security risk management requirements and oversee significant vendor and contractual security reviews.
• Evaluate security obligations associated with research funding, contracts, collaborations, and data-use agreements in partnership with responsible stakeholders.
• Coordinate responses to external security questionnaires and requests for security assurance.
• Present unresolved risks and treatment options to leadership and obtain documented decisions from authorized risk owners.

Security Operations and Technical Risk Oversight

• Establish the security operating model, service expectations, escalation procedures, and performance measures.
• Direct security monitoring, incident detection, vulnerability management, penetration testing, and remediation oversight.
• Oversee external monitoring and response providers.
• Establish security requirements for identity, privileged access, endpoints, networks, cloud services, logging, and sensitive data protection.
• Evaluate significant technology and security architecture decisions and prioritize technical risk reduction initiatives.
• Conduct security-tool selection, deployment, integration, maintenance, and effectiveness.
• Establish accountability and escalation processes for persistent control gaps and overdue remediation.
• Assess the effectiveness of security investments and direct improvements in operational coverage and capability.
• Partner with IT and system owners to implement safeguards, address control gaps, and resolve overdue remediation.
• Review proposed technologies and significant system changes for security risks and recommend appropriate controls.

Incident Leadership and Organizational Resilience

• Own and maintain the incident response program, including plans, exercises, escalation criteria, and continuous improvement.
• Lead coordination of security investigations, containment, recovery, and post-incident corrective actions.
• Advise executives on incident impact, containment priorities, recovery risks, and resource requirements.
• Coordinate with IT, legal, privacy, communications, operational leaders, and external responders as appropriate.
• Partner with organizational leaders and system and business owners to establish security requirements for continuity, backup, and recovery capabilities.
• Ensure incident findings and exercise results inform policy, operational improvements, and investment decisions.
• Provide leadership during significant incidents outside normal business hours under established coverage arrangements.

Research Security Data Protection and Organizational Engagement

• Integrate security requirements into major clinical, research, and technology initiatives.
• Partner with scientific and operational leaders to protect sensitive data while supporting research and collaboration.
• Establish consistent security review processes for research environments, external data sharing, and new partnerships.
• Resolve cross-functional security priorities and communicate practical recommendations to organizational leaders.
• Direct the security awareness program and establish targeted education for employees, researchers, and leadership.
• Partner with researchers, clinical teams, and IT to protect sensitive information throughout its collection, use, storage, transfer, and disposal.
• Establish security requirements for research computing, cloud environments, external collaborations, and data-sharing workflows.
• Evaluate proposed research and clinical workflows and recommend practical safeguards.
• Develop and oversee security awareness training, phishing education, and targeted guidance for specialized teams.
• Communicate security requirements clearly and support their implementation across departments.