Director of Information Security, Vytalize Health
Salary not provided
+ Annual bonus potential
Expert level
Remote in US
Value-based care platform
Be an early applicant
Value-based care platform
201-500 employees
HealthcareB2BCustomer serviceSaaS
Be an early applicant
Salary not provided
+ Annual bonus potential
Expert level
Remote in US
201-500 employees
HealthcareB2BCustomer serviceSaaS
Company mission
To accelerate the transition to value-based care by taking care of the doctors who take care of us.
Role
Who you are
- 15+ years of experience in cybersecurity and secure configuration of systems within the healthcare industry
- Certifications such as CISM, CISA, CISSP, etc. and bachelor’s degree or equivalent in Computer Science, Computer Engineering, Business Administration
- Strong knowledge of incident response, orchestration, automation, and threat hunting processes
- Expertise in evaluation and recommend enterprise cyber security architecture tools and solutions
- Knowledge of Health Insurance Portability and Accountability Act (HIPAA), Health Information
- Technology for Economic and Clinical Health (HITECH), and Payment Card Industry Data Security Standards (PCI DSS)
- Expertise with recommending and designing enterprise information security tools and solutions
- Expertise with information security risk and risk management processes
- Mentor team members, fostering an environment of continuous learning and professional development in advanced security technologies
- Collaborate closely with the cybersecurity team to develop comprehensive security strategies and resolve complex cyber security issues
- Leadership role in defining AI, tools, techniques, and technologies used to connect and secure the Vytalize ecosystem
- Experience with development of compliance monitoring programs to identify control deficiencies and recommend process improvements
- Sound business discernment and flexibility to identify compensating or mitigating controls to reduce risk
- Excellent written and verbal communication skills
- Bachelor's degree or equivalent in Computer Science, Computer Engineering, Business Administration
- Monitor the threat landscape and intel to communicate timely and a sense of urgency the vulnerabilities being exploited and recommendations for remediation, monitoring and/or mitigating controls
- Excellent interpersonal and broad technical skills
- Excellent communication, leadership, and problem-solving skills
- Demonstrated ability to drive organizational growth and meet operational goals
- Financial acumen with experience in budget management and reporting
- Current awareness of healthcare industry trends and regulatory changes
- Entrepreneurial spirit, a sense of ownership and comfortable operating in ambiguity
What the job involves
- The Director of Information Security is responsible for the high-level cyber security design and blueprint
- Leads in strategic development and provides governance for the execution of a multi-year enterprise cyber security strategy using current, emerging, and next gen technologies
- Works closely with the cyber security team and IT teams to transition from design or pilot to deployment and ensure all appropriate documentation and processes are developed in accordance with the information security policies
- Oversight and management of the information risk management program
- This role ensures the protection of patient data and organizational information assets, aligning with regulatory requirements and industry best practices
- Leadership role in planning, recommending, tools, techniques and technologies to protect and secure Vytalize infrastructure, systems, and data
- Development of orchestration, automation, and response and integration and streamline the different security tools to reduce mean time to detect (MTTD) and mean time to respond (MTTR), improving overall security posture
- Evaluates financial and resources and recommends new information security products
- Provides information security expertise in the development of complex solutions and new information security projects. Serves as the technical information security subject matter
- Maintains knowledge of emerging technologies for future information security tools and products. Develop and socialize the information security technologies vision and roadmap
- Develop, maintenance, and test of the business continuity plans to effectively sustain business process during and after a disruption
- Develop, maintenance, and test of the crisis communication plan to effectively communicate with internal and external stakeholders during and after a disruption
- Develop, maintenance, and test of the disaster recovery plan communication to effectively restore the operability of a system, application, or infrastructure
- Integration of the incident response plan into the disaster recovery and business continuity, serve as an incident response lead, and assist with testing of the incident response plan
- Develop and maintain the training programs to educate employees on regulatory and cyber security and privacy best practices, fostering a culture of awareness and accountability
- Conduct regular simulated phishing exercises to educate and detect malicious emails and other malicious events
- Develop metrics to demonstrate the effectiveness of the training program and improve phishing detection and response
- Develop a cyber security risk management program to quantify and qualify cyber security threats, vulnerabilities, and risks and apply risk mitigation strategies
- Conduct comprehensive risk assessments to identify potential threats and vulnerabilities within the organization's operations
- Identify, assess, and prioritize risks related to the organization’s operations, processes, and systems
- Develop and maintain a cyber security risk register with the risks, risk ratings, risk mitigation strategies and action plans
- Monitor risk exposure and risk action plans and report to the Chief Information Security Officer and the Compliance Committee
- Collaborate with the compliance team regarding the cyber security risks and the action plans
- Prepare and distribute regular reports to management and stakeholders summarizing risk assessments, compliance status, risk treatments plans, and recommendations for improvement
- Conduct vendor risk assessments to identify and document potential supplier cyber security risks, threats, and vulnerabilities for management approval
- Develop a process for third-party compliance requests monitoring and tracking and ensure timely completion
- Collaborate with legal and procurement teams to manage vendor relationships and ensure timely execution of vendor risk assessments
- Identify data where data is processed, transmitted, and stored to ensure that data is secure and accessible in accordance with business and regulatory requirements and retention
- Collaborate with data analytics to reduce data silos, ensure compliance and information security, non-production environments data is de-identified, and data access in accordance with minimum necessary
- Develop and maintain a Governance Risk and Compliance Committee charter that defines the purpose, goals and objectives, organizational structure, membership and responsibilities and meeting cadence that aligns the regulatory, policy and organizational requirements
- Prepare and distribute Governance Risk and Compliance Committee cyber security reports to summarize risk assessments, compliance status, and recommendations for improvement
- Foster a culture of compliance and risk management throughout the organization
- Monitor and track regulatory changes, ensuring that the organization remains compliant with all relevant cyber security laws, standards, and industry regulations
- Maintain the information security policies and procedures to align with best practices and compliance requirements
- Collaborate with internal and external audit teams, providing documentation and evidence as needed to demonstrate compliance and adherence to the information security policies
- Develop and maintain a cyber security framework continuous assessment process to provide assurances that the controls in place are operating effectively
- Maintain and enhance the vulnerability dashboard to remediate the vulnerability assessment findings, including penetration test, application security test, and internal and external vulnerability scans
- Collaborate with cross-functional teams to socialize the information security tool roadmap to incorporate all requirements into the solution
- Communicate security risks, issues, and recommendations to CISO and stakeholders with the recommendations and residual risk
- Maintain the information security policies to align with information security frameworks and industry best practices
Our take
Vytalize Health is a medicare Accountable Care Organization (ACO) helping healthcare providers move to a values-based approach. It does this through a platform that helps primary care practices access patient data, offer virtual in-home clinics, and foster deeper patient engagement. In this way, it helps providers balance good care outcomes with good business - which will be critical to Vytalize's future growth.
That’s because whilst care improves materially when providers are enrolled in ACOs, studies have found that enrolment in these programs has dropped over recent years. One report suggests it’s because of an elevated ‘downside risk’, through which providers could in fact lose money by failing to hit specific ACO targets. This means it’s crucial that an ACO can offer genuinely business-optimization solutions, to incentivize a provider’s enrolment in the program.
Vitalyze Health is clearly performing well in this regard. It’s working with hundreds of providers across a number of states. This, along with plans to extend its coverage to every US state, reflect a company that’s struck the right balance between promoting both patient and business outcomes. And with significant funding, the company is on its way towards accelerating growth and moving towards its goal of strengthening primary care practices.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
34% employee growth in 12 months
Company
Funding (last 2 of 5 rounds)
Feb 2023
$100m
LATE VC
Apr 2022
$50m
SERIES B
Total funding: $179.5m
Company benefits
- Fully Remote & Flexible Environment
- Annual Bonus Potential
- Health Benefits
- Health & Wellness Stipend
- Home Office Investment
Company values
- Transparency: Put yourself out there
- Kindness: Never let difficult get in the way
- Reliability: Take it from A to Z
- Excellence: Hold yourself to the highest standards
Company HQ
Hoboken, NJ
Articles
Leadership
Faris Ghawi
(Co-Founder & CEO)Previously worked in Project Management at Clark Construction Group, and as a Senior Analyst at Ernst & Young before co-founding Vytalize Health in 2014.
Share this job
View 1 more job at Vytalize Health