Caradigm Jobs

Information Security Manager

Caradigm is a new kind of health IT company formed by GE Healthcare and Microsoft. Our goal is to transform care by empowering health systems and providers with the real-time, system-wide data and intelligence needed to improve care quality and the patient experience, and ultimately, the economics of health and wellness.

Caradigm combines the power of an open technology platform and collaborative clinical applications to bring together disparate patient data and transform it into intelligence. We enable others in the industry to take advantage of the platform to innovate—rapidly generating a new era of applications to improve population management. Our goal is to make it easy for caregivers across the entire healthcare continuum to gain the insight they need to collaborate with ease and provide the best patient care possible.

We’re looking for an Information Security Manager to be responsible for safeguarding systems and data within corporate and production infrastructure. This includes working with the CIO, policy managers, auditors, business managers and vendors to observe and monitor the security of IT systems and services.

The Information Security Manager must keep current on the methodologies, tools, and configuration of IT security controls including but not limited to firewalls/IPS, antivirus/malware, and system hardening. The manager will establish company-wide security standards and procedures, and enforce training and awareness by vendors and business managers. The manager develops incident response procedures for handling security breaches, internal communication management for system security updates and provides estimates of budgetary requirements for technical security control implementations and upgrades.

Essential Responsibilities

• Supports a trustworthy physical computing environment that protects customer data, intellectual property, people, and the critical infrastructure facilities in which they reside or operate. Achieves superior business results through outstanding vendor performance. Achieves continuous compliance with all security operations controls and objectives.

• Researches, proposes, analyzes, designs, and delivers security control implementation frameworks that are appropriate for the business and its technology strategies such as hosted-customer solutions, cloud services, e-discovery, tool evaluation, testing, and integration

• Participates in the architecture governance process. Provides technical guidance to project teams and vendors as appropriate.

• Implement Enterprise Information Security Standards

• Plans and supervises the support and maintenance for the enterprise information security including:

- Environment administration of all access rights to the overall network and applications within the network

- Monitoring

- Vulnerability scanning

- Firewall administration

- Risk assessments

- Penetration testing

• Plans, supervises and participates (either personally or through team members or vendors) in every project within the environment to assure that security standards are maintained while meeting the business requirements

• Coordinates all audit requirements related to Information Security across all platforms and projects working directly with process owners and vendors to ensure compliance

• Sponsors the teams, which analyzes all vulnerability and patch requirements and assess their impact to the Security environment. Integrate this team’s strategic roadmap into the overall IT strategy to ensure a plan to protect its information assets into the future.

• Maintains accountability for responsible information security program governance through formal reporting

• Develops and implements an information security risk profile that prioritizes risk and the investment and financial strategy required to mitigate those risks

• Creates and maintains security architecture for the enterprise and participate in the solution selection and process development

• Develops security requirements for information technology infrastructure initiatives, selected enterprise applications and, as appropriate, reviews and approves security design of initiatives

• Measures compliance with policy as part of assessing the overall security risk posture of the enterprise, and initiate programs to achieve and maintain an adequate security posture

• Develops and maintains a responsive and effective information security incident response and management capability that will identify, contain and resolve information security incidents, meet compliance and reporting obligations, and uphold chain of custody and rules of civil procedure requirements

Basic Qualifications/Requirements

REQUIRED:

• BS/BA in Computer Science, MIS, IT or equivalent work related experience

• At least one of the following active certifications: CISA, CISM, CISSP

• 7+ year’s executive leadership in information security policy, standards, architecture, technology and programs, with exposure to senior leaders and C-level management

• 7+ year’s information security experience and a track record of developing and implementing a comprehensive security strategy and plan for managing information security according to international standards

• Implementation knowledge of ISO 27001/27002, SSAE16, EUDPD & US:EU Safe Harbor, & HIPAA/HITECH

• Advanced knowledge of TCP/IP, Kerberos, PKI, AD, and Windows Networking in the enterprise and Azure cloud environments

DESIRABLE:

• MS/MA/MBA in Computer Science, MIS, IT or equivalent work related experience

• Minimum of 5 years of experience in healthcare or compliance-oriented industry is preferred

• Other related certifications such as ITIL, PMP, SANS/GSEC, CIPP, CISSP, CRISC, CGEIT, CPA/CA

• Understanding of appropriate leading-edge security technologies and services

• Matrix managing large virtual, remote, and global project teams (15+ members)

• Hiring, developing, leading, motivating, performance managing, and coaching a cross-section of security and technology professionals and managers

• Understanding of emerging technologies and their impact on security architectures: Service Orientated Architecture, Enterprise Frameworks, Message Based information exchange, etc.

• Project managing in the security arena in a healthcare customer facing role

• Managing multiple concurrent change initiatives

• Facilitating issue resolution by analyzing complex situations at high level as well as at the detailed concepts while not losing focus on eventual root cause analysis

• Competent with Microsoft security technologies as well as a strong networking and telecommunications services understanding

Competencies

TECHNICAL SKILLS:

• Information Security Architecture technologies and concepts: Firewalls, intrusion detection, assessment tools, encryption, certificate authority, etc.

• Information systems security, including such areas as identity and access management, security program policies, processes, and procedures

• Understanding of information security and the relationship between threats, vulnerability and information value in the context of risk management

• Excellent vendor management skills with demonstrated experience. Comprehensive understanding of the physical security discipline, focusing on operations. Strong cross-team and cross-group collaboration skills.

• Proficient in the use of Microsoft Office (PowerPoint, Word, Excel, Visio, Project) products

• Proficient with oral and written communication with an emphasis in translating technical content for a non-technical management / executive audience

PROFESSIONAL ATTRIBUTES

• Effective time management, decision making, and leadership in complex situations

• Gather, analyze and interpret business drivers and develop practical solutions that provide adequate support to the business

• Manage and adapt to pressure in a constantly changing environment

• Demonstrate professionalism, attention to detail, creative thinking, integrity, and customer responsiveness in everything you do

• Manage, function effectively within, efficiently distribute expertise, and present to both small and large groups

• Exhibit a positive approach and the ability to work efficiently as either an individual contributor or team lead

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, or national origin.

This employer participates in E-Verify. The employer will provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee's I-9 to confirm work authorization.